933cbc2ce161202631dece41c483c55e7fe46a0211c60276e9f77ddc13cbddbd

Analysis

max time kernel
42s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31-01-2023 08:56

Target

aa089445af4df7e50055b303e1476d26e6fa9307c84732f23be5b5fa129e2d36.exe
Size

249KB
MD5

adbf34a17e486a4e325423ac6e8fecf1
SHA1

80210bdfd834397c5a2644aef1601a965af0b0f2
SHA256

aa089445af4df7e50055b303e1476d26e6fa9307c84732f23be5b5fa129e2d36
SHA512

d1a48945c7c5ba25f9e3b00c06f74690c7470a054eddc029ce67ab772db8c9109cfe0308b1a4a206854bf5494f9eda7ae4fcffd7707d97e0a17ec441022fbd4e
SSDEEP

3072:9uz7istXgHWJy2b9gx+XCFsr1aUQo8x59nFW15jxxCHfgvEZrYkZ5rDdhMhsby3j:9ufistzFh8UQ/x7FO5+HlhYkf4kL

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1396 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1396 powershell.exe

pid	process
1396	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1396	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aa089445af4df7e50055b303e1476d26e6fa9307c84732f23be5b5fa129e2d36.exe

description	pid	process	target process
PID 1308 wrote to memory of 1396	1308	aa089445af4df7e50055b303e1476d26e6fa9307c84732f23be5b5fa129e2d36.exe	powershell.exe
PID 1308 wrote to memory of 1396	1308	aa089445af4df7e50055b303e1476d26e6fa9307c84732f23be5b5fa129e2d36.exe	powershell.exe
PID 1308 wrote to memory of 1396	1308	aa089445af4df7e50055b303e1476d26e6fa9307c84732f23be5b5fa129e2d36.exe	powershell.exe
PID 1308 wrote to memory of 1396	1308	aa089445af4df7e50055b303e1476d26e6fa9307c84732f23be5b5fa129e2d36.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\aa089445af4df7e50055b303e1476d26e6fa9307c84732f23be5b5fa129e2d36.exe
"C:\Users\Admin\AppData\Local\Temp\aa089445af4df7e50055b303e1476d26e6fa9307c84732f23be5b5fa129e2d36.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1308

memory/1308-54-0x0000000000040000-0x0000000000084000-memory.dmp

Filesize
272KB

Download
memory/1308-55-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/1396-56-0x0000000000000000-mapping.dmp

Download
memory/1396-58-0x00000000732F0000-0x000000007389B000-memory.dmp

Filesize
5.7MB

Download
memory/1396-59-0x00000000732F0000-0x000000007389B000-memory.dmp

Filesize
5.7MB

Download