ad60187841efa10ca9d183a54d448313fe9fe2186511b063b61da4c32b807799

Analysis

max time kernel
151s
max time network
143s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 03:20

Target

ad60187841efa10ca9d183a54d448313fe9fe2186511b063b61da4c32b807799.exe
Size

27KB
MD5

e253d4c0bb8a43f0702c7551db80684a
SHA1

de53f8e31fe9aa501823ddfa46e0140e0e5ccdc0
SHA256

ad60187841efa10ca9d183a54d448313fe9fe2186511b063b61da4c32b807799
SHA512

c3c4ac952ac91d028126128f19d75cf966c9f25ba3ce55f2a4168b6b0c25a1cb92f4aaf69c4fe40aeb1527f1e4d6c5ec8753df7009aba2bbdb1474373dbde567
SSDEEP

768:KjiL54xlz6JR0sjxfGV7LL2aC3/Vg4Q9FN:Km54xNmfVfGV7LLCrQ9/

Score

1^/10

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1976	ad60187841efa10ca9d183a54d448313fe9fe2186511b063b61da4c32b807799.exe
1976	ad60187841efa10ca9d183a54d448313fe9fe2186511b063b61da4c32b807799.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	ad60187841efa10ca9d183a54d448313fe9fe2186511b063b61da4c32b807799.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2008	1976	ad60187841efa10ca9d183a54d448313fe9fe2186511b063b61da4c32b807799.exe	26
PID 1976 wrote to memory of 2008	1976	ad60187841efa10ca9d183a54d448313fe9fe2186511b063b61da4c32b807799.exe	26
PID 1976 wrote to memory of 2008	1976	ad60187841efa10ca9d183a54d448313fe9fe2186511b063b61da4c32b807799.exe	26
PID 1976 wrote to memory of 2008	1976	ad60187841efa10ca9d183a54d448313fe9fe2186511b063b61da4c32b807799.exe	26

C:\Users\Admin\AppData\Local\Temp\ad60187841efa10ca9d183a54d448313fe9fe2186511b063b61da4c32b807799.exe
"C:\Users\Admin\AppData\Local\Temp\ad60187841efa10ca9d183a54d448313fe9fe2186511b063b61da4c32b807799.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\syswow64\svchost.exe
  C:\Windows\syswow64\svchost.exe
  2⤵
  PID:2008

memory/1976-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000001FC0000-0x0000000002FC0000-memory.dmp

Filesize
16.0MB

Download
memory/2008-58-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

Filesize
32KB

Download
memory/2008-59-0x00000000000C0000-0x00000000000CA000-memory.dmp

Filesize
40KB

Download