c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4

Analysis

max time kernel
247s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 17:51

Target

c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe
Size

188KB
MD5

1e5810161a4ec44312927050b29a35d4
SHA1

c829c6b232160804c970f9a3642703d4468095f0
SHA256

c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4
SHA512

699ff32dd9b71609aa182cdb7c4e67d21987f0fbaa67b09645e43c16f6c269f2e14f4684b1c91607b4454188dd2c845db63ef2f03342529e52fb60117b4a8daa
SSDEEP

3072:FHgB8Xw6bDtsApPomF+vycSYWUY6yCJC2qzFNmvaEiJIiFT4SCEzFcAcOLKsNert:qB8Xw6bDtsEwI0ycn9yCJCN5N6aEFksP

Score

7^/10

Drops startup file 2 IoCs

Processes:

c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvzGO4WEtsg.exe	c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvzGO4WEtsg.exe	c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe

pid process

1532 c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe

pid process

1532 c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe

description pid process

Token: SeDebugPrivilege 1532 c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe

pid	process
1532	c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe

pid	process
1532	c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe

description	pid	process
Token: SeDebugPrivilege	1532	c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe

description	pid	process	target process
PID 1532 wrote to memory of 1436	1532	c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe	explorer.exe
PID 1532 wrote to memory of 1436	1532	c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe	explorer.exe
PID 1532 wrote to memory of 1436	1532	c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe	explorer.exe
PID 1532 wrote to memory of 1436	1532	c3508c310e184d47c303c0f37275a60e979fe5a0104156805eb017622d9f6ad4.exe	explorer.exe

memory/1532-54-0x0000000074FA1000-0x0000000074FA3000-memory.dmp

Filesize
8KB

Download
memory/1532-55-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1532-56-0x00000000002F0000-0x000000000036F000-memory.dmp

Filesize
508KB

Download