846cf3836da3c05c0d9cc5b5061028294660b1349c44dbf0788d1ccbd837bb6e

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15/02/2023, 13:38

Target

IFS0076545678-98765456.exe
Size

1.6MB
MD5

bb757ad37313ea9480c3b22460ea8749
SHA1

895ded88ec53c39eb247b746535befbfdeaaf1e8
SHA256

846cf3836da3c05c0d9cc5b5061028294660b1349c44dbf0788d1ccbd837bb6e
SHA512

46e30dc7b59b7c3f44bd870a95263cb2d1fae276ab9ca220dd83b8872bc9de362940c44033650443c97ebd5f8d0ceba192af3ad818a696a8ff97f0895200e10a
SSDEEP

12288:gSO4asKoAeMYbjVGLRa5+79GpAhBDA4VGMeGE+tRaZn/+YgIr6gO/aXcz3GTMNIG:9eoAeMOjVG9m2O+Np8eche8R9oKEd

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	964	IFS0076545678-98765456.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1216	964	IFS0076545678-98765456.exe	28
PID 964 wrote to memory of 1216	964	IFS0076545678-98765456.exe	28
PID 964 wrote to memory of 1216	964	IFS0076545678-98765456.exe	28
PID 964 wrote to memory of 1216	964	IFS0076545678-98765456.exe	28
PID 964 wrote to memory of 1664	964	IFS0076545678-98765456.exe	29
PID 964 wrote to memory of 1664	964	IFS0076545678-98765456.exe	29
PID 964 wrote to memory of 1664	964	IFS0076545678-98765456.exe	29
PID 964 wrote to memory of 1664	964	IFS0076545678-98765456.exe	29
PID 964 wrote to memory of 336	964	IFS0076545678-98765456.exe	30
PID 964 wrote to memory of 336	964	IFS0076545678-98765456.exe	30
PID 964 wrote to memory of 336	964	IFS0076545678-98765456.exe	30
PID 964 wrote to memory of 336	964	IFS0076545678-98765456.exe	30
PID 964 wrote to memory of 844	964	IFS0076545678-98765456.exe	31
PID 964 wrote to memory of 844	964	IFS0076545678-98765456.exe	31
PID 964 wrote to memory of 844	964	IFS0076545678-98765456.exe	31
PID 964 wrote to memory of 844	964	IFS0076545678-98765456.exe	31
PID 964 wrote to memory of 688	964	IFS0076545678-98765456.exe	32
PID 964 wrote to memory of 688	964	IFS0076545678-98765456.exe	32
PID 964 wrote to memory of 688	964	IFS0076545678-98765456.exe	32
PID 964 wrote to memory of 688	964	IFS0076545678-98765456.exe	32

C:\Users\Admin\AppData\Local\Temp\IFS0076545678-98765456.exe
"C:\Users\Admin\AppData\Local\Temp\IFS0076545678-98765456.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"
  2⤵
  PID:1216
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"
  2⤵
  PID:1664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"
  2⤵
  PID:336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"
  2⤵
  PID:844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"
  2⤵
  PID:688

memory/964-54-0x00000000002B0000-0x000000000045C000-memory.dmp

Filesize
1.7MB

Download
memory/964-55-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/964-56-0x0000000000250000-0x0000000000258000-memory.dmp

Filesize
32KB

Download