0802394968eda97506836e12c3deb32af74ad1ffcc86b22e4d654d10b865241c

Analysis

max time kernel
48s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/02/2023, 17:09

Target
quote.exe
Size 814KB
Sample230207-vn5cssga61
SHA256 0802394968eda97506836e12c3deb32af74ad1ffcc86b22e4d654d10b865241c
MD5 6df9213dd65135dd35c056943d5c8034
SHA1 8a248204ed3dc2b22d4c72cf849d9f9e7cbe42cb
SHA512 890993bbea43465e04417cc8bed784734c7e723dcbf5cb48de953d8bd321e1c57254068354dbd9b46f3968762d18cfd81ebaa6af18c70e3916b487fc1dc7dbdb
SSDEEP 12288:psawHRr/CB06KuLphq8KoPZOGmyyGIuWo4A5RGgMVSAx6dEeT4X3WRX0XFHbDDlG:psawxO5dhqT82AESAfE4X3QX8Z
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	860	quote.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 588	860	quote.exe	27
PID 860 wrote to memory of 588	860	quote.exe	27
PID 860 wrote to memory of 588	860	quote.exe	27
PID 860 wrote to memory of 588	860	quote.exe	27
PID 860 wrote to memory of 1384	860	quote.exe	28
PID 860 wrote to memory of 1384	860	quote.exe	28
PID 860 wrote to memory of 1384	860	quote.exe	28
PID 860 wrote to memory of 1384	860	quote.exe	28
PID 860 wrote to memory of 332	860	quote.exe	29
PID 860 wrote to memory of 332	860	quote.exe	29
PID 860 wrote to memory of 332	860	quote.exe	29
PID 860 wrote to memory of 332	860	quote.exe	29
PID 860 wrote to memory of 688	860	quote.exe	30
PID 860 wrote to memory of 688	860	quote.exe	30
PID 860 wrote to memory of 688	860	quote.exe	30
PID 860 wrote to memory of 688	860	quote.exe	30
PID 860 wrote to memory of 792	860	quote.exe	31
PID 860 wrote to memory of 792	860	quote.exe	31
PID 860 wrote to memory of 792	860	quote.exe	31
PID 860 wrote to memory of 792	860	quote.exe	31

C:\Users\Admin\AppData\Local\Temp\quote.exe
"C:\Users\Admin\AppData\Local\Temp\quote.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\quote.exe
  "C:\Users\Admin\AppData\Local\Temp\quote.exe"
  2⤵
  PID:588
- C:\Users\Admin\AppData\Local\Temp\quote.exe
  "C:\Users\Admin\AppData\Local\Temp\quote.exe"
  2⤵
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\quote.exe
  "C:\Users\Admin\AppData\Local\Temp\quote.exe"
  2⤵
  PID:332
- C:\Users\Admin\AppData\Local\Temp\quote.exe
  "C:\Users\Admin\AppData\Local\Temp\quote.exe"
  2⤵
  PID:688
- C:\Users\Admin\AppData\Local\Temp\quote.exe
  "C:\Users\Admin\AppData\Local\Temp\quote.exe"
  2⤵
  PID:792

memory/860-54-0x0000000000340000-0x0000000000412000-memory.dmp

Download

memory/860-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Download

memory/860-56-0x0000000000330000-0x0000000000344000-memory.dmp

Download

memory/860-57-0x0000000000590000-0x000000000059C000-memory.dmp

Download

memory/860-58-0x0000000005DA0000-0x0000000005E30000-memory.dmp

Download

memory/860-59-0x0000000004F60000-0x0000000004F98000-memory.dmp

Download