1dff12ee6b61c31e2a9f5364f4c6bdbe8639cec3343ab4ca0ee7b43ce3cf0fd5

Analysis

max time kernel
27s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-12-2022 14:06

Target

main-file-setup/main-file-setup.exe
Size

550.0MB
MD5

ca89705a231aabedd38eae9c3001db3b
SHA1

a1e6c57986789a8cbc6c4d54ba3382dafef30f0b
SHA256

4196cb4e7ce6c3de44472fc67075ac56b9f5971f8fcf706e06edeca3a94e88d9
SHA512

6791283bb8f4704446df861d1e8c5102cd27c3e483326bc5c2231bd541c8344c9ebde96e3b921dcf27b918f58a312ef8b466e3f67875580f8689a6335db83749
SSDEEP

6144:sDSyydUgNDebfYDZWbg5c53u+cEIJ5nz59/cqok+trxLRsd9FtkEWU98ek6Br80X:LVN6bggSYqYthI/NLH3Sn2vLTl0A

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1032	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1032	964	main-file-setup.exe	28
PID 964 wrote to memory of 1032	964	main-file-setup.exe	28
PID 964 wrote to memory of 1032	964	main-file-setup.exe	28
PID 964 wrote to memory of 1032	964	main-file-setup.exe	28

C:\Users\Admin\AppData\Local\Temp\main-file-setup\main-file-setup.exe
"C:\Users\Admin\AppData\Local\Temp\main-file-setup\main-file-setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1032

memory/964-54-0x0000000000AC0000-0x0000000000B44000-memory.dmp

Filesize
528KB

Download
memory/964-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1032-56-0x0000000000000000-mapping.dmp

Download
memory/1032-58-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/1032-59-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download