e19e24b6988b0ff530a7479dbf01da1d633a713b80878f475161eb58562a9e70

Analysis

max time kernel
33s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-01-2023 18:28

Target

SetupFileSoftware/SetupFileSoftware.exe
Size

819.4MB
MD5

6169c33081a2a4bc10b7919a78ca971d
SHA1

94a1ece56ca2110a232cfd4092da62d7ba57a1da
SHA256

9aef8fdc5e0b17b200a92382229795afeda78f01f8e9cd99fcad147d7bb146c3
SHA512

9a55a46a928ab1157f162c80e8c1c648e36d1a1d5e8b4b69eb2907cda7ea1cd9c54395ac5bc95753eb9f294146dfb90940416154e9bc5db25b9305a95b601d07
SSDEEP

196608:FF8LwftnNw5RQ1bXFdyTjdK3svnOIaUOrQ1bXFd6:FektN7NXfyAsvUUrNXf6

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

896 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 896 powershell.exe

pid	process
896	powershell.exe

description	pid	process
Token: SeDebugPrivilege	896	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SetupFileSoftware.exe

description	pid	process	target process
PID 1000 wrote to memory of 896	1000	SetupFileSoftware.exe	powershell.exe
PID 1000 wrote to memory of 896	1000	SetupFileSoftware.exe	powershell.exe
PID 1000 wrote to memory of 896	1000	SetupFileSoftware.exe	powershell.exe
PID 1000 wrote to memory of 896	1000	SetupFileSoftware.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\SetupFileSoftware\SetupFileSoftware.exe
"C:\Users\Admin\AppData\Local\Temp\SetupFileSoftware\SetupFileSoftware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000

memory/896-56-0x0000000000000000-mapping.dmp

Download
memory/896-58-0x0000000074600000-0x0000000074BAB000-memory.dmp

Filesize
5.7MB

Download
memory/896-59-0x0000000074600000-0x0000000074BAB000-memory.dmp

Filesize
5.7MB

Download
memory/1000-54-0x0000000000080000-0x0000000000862000-memory.dmp

Filesize
7.9MB

Download
memory/1000-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download