0ba8881e6cc0bfc2c0669f8d96ee6c43afe7b5921dc93a259b4b27a1cfbec1f3

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-01-2023 14:28

Target

filesetup_v17.3.4.jpg.exe
Size

253KB
MD5

f50a1d78d091608f158eaccf0868aec3
SHA1

6c8ace1c29eb95542bc19a2170c979e17cff5fca
SHA256

0ba8881e6cc0bfc2c0669f8d96ee6c43afe7b5921dc93a259b4b27a1cfbec1f3
SHA512

95a313e557a22af4e03eeaf556452ed2e65daa4064183ee5feecb984cf2b5ea2541a54789f5cd63d12aed2d1814512a82e03cdf165b5e2338587302f577432fb
SSDEEP

3072:i14gX/gff43ix4iXQs8/NEK39fhEkC9EgaxOldWrS1/jdqw8PjNxtv9Tl0ZgQW6o:i14gZb7WFYQzvuB5U92/GI0/C6V

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1192 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1192 powershell.exe

pid	process
1192	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1192	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

filesetup_v17.3.4.jpg.exe

description	pid	process	target process
PID 1908 wrote to memory of 1192	1908	filesetup_v17.3.4.jpg.exe	powershell.exe
PID 1908 wrote to memory of 1192	1908	filesetup_v17.3.4.jpg.exe	powershell.exe
PID 1908 wrote to memory of 1192	1908	filesetup_v17.3.4.jpg.exe	powershell.exe
PID 1908 wrote to memory of 1192	1908	filesetup_v17.3.4.jpg.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\filesetup_v17.3.4.jpg.exe
"C:\Users\Admin\AppData\Local\Temp\filesetup_v17.3.4.jpg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

memory/1192-56-0x0000000000000000-mapping.dmp

Download
memory/1192-58-0x0000000073BE0000-0x000000007418B000-memory.dmp

Filesize
5.7MB

Download
memory/1192-59-0x0000000073BE0000-0x000000007418B000-memory.dmp

Filesize
5.7MB

Download
memory/1908-54-0x0000000000C90000-0x0000000000CD4000-memory.dmp

Filesize
272KB

Download
memory/1908-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download