9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0

Analysis

max time kernel
137s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 16:41

Target

9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe
Size

26KB
MD5

e4fed19e8f63e7c189780f8e17f6c96a
SHA1

d5f88a4cabcb97c835026f13efcfd750077ccba6
SHA256

9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0
SHA512

3d9dffce41f5995ad95423e424d0781560aec55c78a400238e69ca6bb737a40039acf2d601eb97086249e08424cdee53bbecf3e3d41c1ef1da010857f4eee0eb
SSDEEP

384:uKm5kNVZXha/HJveCAqnnzgbJWQZjlkr6aeNQ3wdRE3bwxaEIpyUJoLpzuK+W2it:ayNgpvVgNKrd36RErw41yUkuGgAQ9PA

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1988	9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe
1988	9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe
1988	9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe
1988	9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe
1988	9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1988	9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe
1988	9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2012	1988	9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe	26
PID 1988 wrote to memory of 2012	1988	9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe	26
PID 1988 wrote to memory of 2012	1988	9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe	26
PID 1988 wrote to memory of 2012	1988	9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe	26

C:\Users\Admin\AppData\Local\Temp\9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe
"C:\Users\Admin\AppData\Local\Temp\9abfa893f2d7c1a76b2e6ddc5bb31da719a549c362caa595dd4d0ca96e781bd0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\syswow64\svchost.exe
  C:\Windows\syswow64\svchost.exe
  2⤵
  PID:2012

memory/1988-54-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/1988-55-0x0000000001FF0000-0x0000000002FF0000-memory.dmp

Filesize
16.0MB

Download
memory/2012-56-0x0000000000000000-mapping.dmp

Download
memory/2012-58-0x0000000000FE0000-0x0000000000FE8000-memory.dmp

Filesize
32KB

Download
memory/2012-59-0x0000000000080000-0x000000000008A000-memory.dmp

Filesize
40KB

Download