b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465

Analysis

max time kernel
146s
max time network
198s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30/11/2022, 23:00

Target

b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe
Size

25KB
MD5

9dcc0d6bee7f83972667b990999d8cd0
SHA1

1f68b745d6ce72cbfde9b51661cd358f1d269b1a
SHA256

b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465
SHA512

93bd24bdda4167784fe7c103036becc19990a9e3c7ed623b686f8002af5591ccca36736a56666bdedeeaf32d629805badebc95ef7710755d9789ba4f10d55731
SSDEEP

384:uFuK+X4LNF9oJn0yzhv3BWgNJdgLOq+SS/v26JVS5AoBjrwVVL0QCh7:uZU45nC0yzl3BFJg5+SSn26JVVSwVE7

Score

7^/10

Deletes itself 1 IoCs

pid	Process
960	svchost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe
836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe
836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe
836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe
836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe
836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe
836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe
836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 960	836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe	28
PID 836 wrote to memory of 960	836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe	28
PID 836 wrote to memory of 960	836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe	28
PID 836 wrote to memory of 960	836	b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe	28

C:\Users\Admin\AppData\Local\Temp\b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe
"C:\Users\Admin\AppData\Local\Temp\b41751b2d62a6fe5acb33047421abc8dbb3dcc1eeb77efbb3b241ee00b281465.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\syswow64\svchost.exe
  C:\Windows\syswow64\svchost.exe
  2⤵
  - Deletes itself
  PID:960

memory/836-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/836-59-0x0000000001E50000-0x0000000002E50000-memory.dmp

Filesize
16.0MB

Download
memory/960-57-0x0000000000C20000-0x0000000000C28000-memory.dmp

Filesize
32KB

Download
memory/960-58-0x0000000000080000-0x000000000008A000-memory.dmp

Filesize
40KB

Download