6bd34841d476beec52a2d0747a4ed50195d82ea77df6d2bcf42041911f945ec6

Analysis

max time kernel
49s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 21:27

Target

file.exe
Size

1.3MB
MD5

a25f82f79bbeb8abcf52c7912ebbe2ea
SHA1

939e1b0017a15e77bc7a218a70528b368d8c5212
SHA256

6bd34841d476beec52a2d0747a4ed50195d82ea77df6d2bcf42041911f945ec6
SHA512

9385f1894e02966fc430ae053c2d76b2d8ecd5c870e3f1cdd8f82a2b13c52bbe04a615bd218f0b9aa1d326372c3895cd25aabf485fc3de6d52caccc44515e7d7
SSDEEP

24576:dA3LrxN5IC54TWM7DK2XF9KjmmOhPcBPU+gjhQuH0BvYx4He5xQn7Qym2XS1qN3U:iPtgisnXF9KgdcBcplH0uxZo7Qym1U

Score

1^/10

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	file.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1716	1944	file.exe	27
PID 1944 wrote to memory of 1716	1944	file.exe	27
PID 1944 wrote to memory of 1716	1944	file.exe	27
PID 1944 wrote to memory of 1716	1944	file.exe	27
PID 1944 wrote to memory of 988	1944	file.exe	28
PID 1944 wrote to memory of 988	1944	file.exe	28
PID 1944 wrote to memory of 988	1944	file.exe	28
PID 1944 wrote to memory of 988	1944	file.exe	28
PID 1944 wrote to memory of 948	1944	file.exe	29
PID 1944 wrote to memory of 948	1944	file.exe	29
PID 1944 wrote to memory of 948	1944	file.exe	29
PID 1944 wrote to memory of 948	1944	file.exe	29
PID 1944 wrote to memory of 1992	1944	file.exe	30
PID 1944 wrote to memory of 1992	1944	file.exe	30
PID 1944 wrote to memory of 1992	1944	file.exe	30
PID 1944 wrote to memory of 1992	1944	file.exe	30
PID 1944 wrote to memory of 1692	1944	file.exe	31
PID 1944 wrote to memory of 1692	1944	file.exe	31
PID 1944 wrote to memory of 1692	1944	file.exe	31
PID 1944 wrote to memory of 1692	1944	file.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  PID:1716
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  PID:988
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  PID:948
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  PID:1992
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  PID:1692

memory/1944-54-0x0000000000360000-0x00000000004A8000-memory.dmp

Filesize
1.3MB

Download
memory/1944-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1944-56-0x0000000000300000-0x0000000000314000-memory.dmp

Filesize
80KB

Download
memory/1944-57-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/1944-58-0x0000000008320000-0x000000000841C000-memory.dmp

Filesize
1008KB

Download
memory/1944-59-0x0000000008420000-0x00000000084C6000-memory.dmp

Filesize
664KB

Download