376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-01-2023 15:54

Target

file.exe
Size

611KB
MD5

0c802d4ef37a0ba9232605f48d0e07b3
SHA1

b8b7afcd7a2f389afcac5c0c3fda472f1fe76290
SHA256

376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54
SHA512

b41a109acc1b13f508f0980b068676208bd5ee92ff3b0e17044e7c0d0042ec2e1fca2ba6896461b1cf8b8e05e096718f1f7de726c425b95400396af0f8e367a7
SSDEEP

12288:RY/BFjCfuXdm4S4w1gzs48VUiHUqF/a82lv4b+uze+RjaXsaNCD5bAMI:CXYwAVr0y/a8mAmFra

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

file.exe

pid process

1832 file.exe
1832 file.exe
1832 file.exe
1832 file.exe
1832 file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 1832 file.exe

description	pid	process
Token: SeDebugPrivilege	1832	file.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1832 wrote to memory of 1772	1832	file.exe	file.exe
PID 1832 wrote to memory of 1772	1832	file.exe	file.exe
PID 1832 wrote to memory of 1772	1832	file.exe	file.exe
PID 1832 wrote to memory of 1772	1832	file.exe	file.exe
PID 1832 wrote to memory of 1228	1832	file.exe	file.exe
PID 1832 wrote to memory of 1228	1832	file.exe	file.exe
PID 1832 wrote to memory of 1228	1832	file.exe	file.exe
PID 1832 wrote to memory of 1228	1832	file.exe	file.exe
PID 1832 wrote to memory of 2028	1832	file.exe	file.exe
PID 1832 wrote to memory of 2028	1832	file.exe	file.exe
PID 1832 wrote to memory of 2028	1832	file.exe	file.exe
PID 1832 wrote to memory of 2028	1832	file.exe	file.exe
PID 1832 wrote to memory of 2036	1832	file.exe	file.exe
PID 1832 wrote to memory of 2036	1832	file.exe	file.exe
PID 1832 wrote to memory of 2036	1832	file.exe	file.exe
PID 1832 wrote to memory of 2036	1832	file.exe	file.exe
PID 1832 wrote to memory of 1716	1832	file.exe	file.exe
PID 1832 wrote to memory of 1716	1832	file.exe	file.exe
PID 1832 wrote to memory of 1716	1832	file.exe	file.exe
PID 1832 wrote to memory of 1716	1832	file.exe	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
PID:1772

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
PID:1228

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
PID:2028

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
PID:2036

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
PID:1716

memory/1832-54-0x0000000000390000-0x0000000000430000-memory.dmp

Filesize
640KB

Download
memory/1832-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1832-56-0x0000000000430000-0x0000000000440000-memory.dmp

Filesize
64KB

Download
memory/1832-57-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download
memory/1832-58-0x0000000005070000-0x00000000050CA000-memory.dmp

Filesize
360KB

Download
memory/1832-59-0x0000000000840000-0x0000000000862000-memory.dmp

Filesize
136KB

Download