d4569f9f84e4e423a3a0d750e28dab25c2fb67d1a94afb0b91da62da30f10a78

Analysis

max time kernel
49s
max time network
45s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 15:50

Target

d4569f9f84e4e423a3a0d750e28dab25c2fb67d1a94afb0b91da62da30f10a78.exe
Size

28KB
MD5

b5b30a2d2e096c97bf167511503f8494
SHA1

977e40cec36b8411c99ac5738898e6c6101bc4a2
SHA256

d4569f9f84e4e423a3a0d750e28dab25c2fb67d1a94afb0b91da62da30f10a78
SHA512

dcac75bc9decc00ab4872d8b27a7961344dc33728faee0adabb7859755369348af7376e8dc883af276e02424ebe4fdc687888cfe9f360f2574b7a822a8236f21
SSDEEP

384:Qk9dMCyGYv53LfK1Eg5js6IjdmOa9psNcHt7mfURS:ZaCfa53LfKGkjsbU9p5ZmMRS

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1260	d4569f9f84e4e423a3a0d750e28dab25c2fb67d1a94afb0b91da62da30f10a78.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	d4569f9f84e4e423a3a0d750e28dab25c2fb67d1a94afb0b91da62da30f10a78.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 772	1260	d4569f9f84e4e423a3a0d750e28dab25c2fb67d1a94afb0b91da62da30f10a78.exe	28
PID 1260 wrote to memory of 772	1260	d4569f9f84e4e423a3a0d750e28dab25c2fb67d1a94afb0b91da62da30f10a78.exe	28
PID 1260 wrote to memory of 772	1260	d4569f9f84e4e423a3a0d750e28dab25c2fb67d1a94afb0b91da62da30f10a78.exe	28

C:\Users\Admin\AppData\Local\Temp\d4569f9f84e4e423a3a0d750e28dab25c2fb67d1a94afb0b91da62da30f10a78.exe
"C:\Users\Admin\AppData\Local\Temp\d4569f9f84e4e423a3a0d750e28dab25c2fb67d1a94afb0b91da62da30f10a78.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 560
  2⤵
  PID:772

memory/772-57-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Filesize
8KB

Download
memory/1260-54-0x000007FEF4900000-0x000007FEF5323000-memory.dmp

Filesize
10.1MB

Download
memory/1260-55-0x000007FEF3860000-0x000007FEF48F6000-memory.dmp

Filesize
16.6MB

Download