eff9dc2494f14b6708a540c6a6f094b1f9286545e6d85c78923700933b9411fe

Analysis

max time kernel
42s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-01-2023 18:38

Target

tmp.exe
Size

647KB
MD5

4c1dd8060697df9261ae84d6a28d457e
SHA1

d6f9d17e217fe9d7845a90cec6be43f01e31d1c5
SHA256

eff9dc2494f14b6708a540c6a6f094b1f9286545e6d85c78923700933b9411fe
SHA512

8b06953d3e47b6007515486732874a9c9c69ca6cde4f5f7e1fcc30d7574765eb497ea59e92e817efa87a5688f6f24dd73b655c6df01cf9f0997cf2b2732a662f
SSDEEP

12288:tqDcBowWlaqMqNcv2OwGNpDdSgq0f6MikPA7Weh3ih9HeA:tqD2ow1qtcntNp4gIBkPIBYTf

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

tmp.exe

pid process

1516 tmp.exe
1516 tmp.exe
1516 tmp.exe
1516 tmp.exe
1516 tmp.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 1516 tmp.exe

description	pid	process
Token: SeDebugPrivilege	1516	tmp.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 1516 wrote to memory of 1520	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 1520	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 1520	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 1520	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 328	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 328	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 328	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 328	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 572	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 572	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 572	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 572	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 584	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 584	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 584	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 584	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 664	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 664	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 664	1516	tmp.exe	tmp.exe
PID 1516 wrote to memory of 664	1516	tmp.exe	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
PID:1520

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
PID:328

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
PID:572

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
PID:584

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
PID:664

memory/1516-54-0x0000000000210000-0x00000000002B8000-memory.dmp

Filesize
672KB

Download
memory/1516-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1516-56-0x0000000000490000-0x00000000004A4000-memory.dmp

Filesize
80KB

Download
memory/1516-57-0x00000000005A0000-0x00000000005AA000-memory.dmp

Filesize
40KB

Download
memory/1516-58-0x0000000005F00000-0x0000000005F5A000-memory.dmp

Filesize
360KB

Download
memory/1516-59-0x00000000007B0000-0x00000000007D2000-memory.dmp

Filesize
136KB

Download