16d842e8d7472cf98eee098f6a0f9b3ad5f3668928c86a898da187dc9106b6e3

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 10:05

Target

Order Request.exe
Size

1.0MB
MD5

0751cb9453ccc6d6576c8e6583e8e8df
SHA1

c78f7efa2c57394097eca6c222f52dc6c5169515
SHA256

6f6927018a479ebbb860f5010a88d14ddaa2c64756e06ba9f0326ca15462b4e4
SHA512

ca93c74695ffc078236a868dfa8fdbaeec4af0cf3075377390aa6533c0fc4944aa0ac62fbe20cc7e2eaba1581cfbc48adcdac554ccefb4ce700dd4f803f7a35a
SSDEEP

24576:vZqB/XCxqrTElFByv3DCYlWSGHsGoR4Dq:GX5nE+3DCYlWSGMJ4+

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	Order Request.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2028	1088	Order Request.exe	28
PID 1088 wrote to memory of 2028	1088	Order Request.exe	28
PID 1088 wrote to memory of 2028	1088	Order Request.exe	28
PID 1088 wrote to memory of 2028	1088	Order Request.exe	28
PID 1088 wrote to memory of 2032	1088	Order Request.exe	29
PID 1088 wrote to memory of 2032	1088	Order Request.exe	29
PID 1088 wrote to memory of 2032	1088	Order Request.exe	29
PID 1088 wrote to memory of 2032	1088	Order Request.exe	29
PID 1088 wrote to memory of 1748	1088	Order Request.exe	30
PID 1088 wrote to memory of 1748	1088	Order Request.exe	30
PID 1088 wrote to memory of 1748	1088	Order Request.exe	30
PID 1088 wrote to memory of 1748	1088	Order Request.exe	30
PID 1088 wrote to memory of 1732	1088	Order Request.exe	31
PID 1088 wrote to memory of 1732	1088	Order Request.exe	31
PID 1088 wrote to memory of 1732	1088	Order Request.exe	31
PID 1088 wrote to memory of 1732	1088	Order Request.exe	31
PID 1088 wrote to memory of 1996	1088	Order Request.exe	32
PID 1088 wrote to memory of 1996	1088	Order Request.exe	32
PID 1088 wrote to memory of 1996	1088	Order Request.exe	32
PID 1088 wrote to memory of 1996	1088	Order Request.exe	32

C:\Users\Admin\AppData\Local\Temp\Order Request.exe
"C:\Users\Admin\AppData\Local\Temp\Order Request.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\Order Request.exe
  "C:\Users\Admin\AppData\Local\Temp\Order Request.exe"
  2⤵
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\Order Request.exe
  "C:\Users\Admin\AppData\Local\Temp\Order Request.exe"
  2⤵
  PID:2032
- C:\Users\Admin\AppData\Local\Temp\Order Request.exe
  "C:\Users\Admin\AppData\Local\Temp\Order Request.exe"
  2⤵
  PID:1748
- C:\Users\Admin\AppData\Local\Temp\Order Request.exe
  "C:\Users\Admin\AppData\Local\Temp\Order Request.exe"
  2⤵
  PID:1732
- C:\Users\Admin\AppData\Local\Temp\Order Request.exe
  "C:\Users\Admin\AppData\Local\Temp\Order Request.exe"
  2⤵
  PID:1996

memory/1088-54-0x0000000000300000-0x000000000040C000-memory.dmp

Filesize
1.0MB

Download
memory/1088-55-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1088-56-0x00000000001D0000-0x00000000001E6000-memory.dmp

Filesize
88KB

Download
memory/1088-57-0x0000000000200000-0x000000000020E000-memory.dmp

Filesize
56KB

Download
memory/1088-58-0x0000000005D80000-0x0000000005E52000-memory.dmp

Filesize
840KB

Download
memory/1088-59-0x00000000050A0000-0x000000000513E000-memory.dmp

Filesize
632KB

Download