589459202b13d455eb66686b0ad19c3dcadc8b7b915515fced84ede742868c10

Analysis

max time kernel
42s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/03/2023, 12:08

Target
rAwb8457108962.exe
Size 821KB
Sample230307-pawkvahc5z
SHA256 589459202b13d455eb66686b0ad19c3dcadc8b7b915515fced84ede742868c10
MD5 234abaea771438b5dcba3506dfc75e9c
SHA1 46a984952144e356888f6da9a35514cc6c9c5140
SHA512 ea58f8215bfb05d8ccd06f7d6960d73201541d788371813bd5b0b6843902733a978dd98266d8c824c71f82da890ad1c773eb522919d7d25c90621e6f520ec4c9
SSDEEP 24576:nUXFrT6a2IrjaxR3beTuE7d1bf+e3k7PMO/:OT6cWRyuE51wES
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	rAwb8457108962.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1324	2020	rAwb8457108962.exe	28
PID 2020 wrote to memory of 1324	2020	rAwb8457108962.exe	28
PID 2020 wrote to memory of 1324	2020	rAwb8457108962.exe	28
PID 2020 wrote to memory of 1324	2020	rAwb8457108962.exe	28
PID 2020 wrote to memory of 596	2020	rAwb8457108962.exe	29
PID 2020 wrote to memory of 596	2020	rAwb8457108962.exe	29
PID 2020 wrote to memory of 596	2020	rAwb8457108962.exe	29
PID 2020 wrote to memory of 596	2020	rAwb8457108962.exe	29
PID 2020 wrote to memory of 524	2020	rAwb8457108962.exe	30
PID 2020 wrote to memory of 524	2020	rAwb8457108962.exe	30
PID 2020 wrote to memory of 524	2020	rAwb8457108962.exe	30
PID 2020 wrote to memory of 524	2020	rAwb8457108962.exe	30
PID 2020 wrote to memory of 764	2020	rAwb8457108962.exe	31
PID 2020 wrote to memory of 764	2020	rAwb8457108962.exe	31
PID 2020 wrote to memory of 764	2020	rAwb8457108962.exe	31
PID 2020 wrote to memory of 764	2020	rAwb8457108962.exe	31
PID 2020 wrote to memory of 964	2020	rAwb8457108962.exe	32
PID 2020 wrote to memory of 964	2020	rAwb8457108962.exe	32
PID 2020 wrote to memory of 964	2020	rAwb8457108962.exe	32
PID 2020 wrote to memory of 964	2020	rAwb8457108962.exe	32

C:\Users\Admin\AppData\Local\Temp\rAwb8457108962.exe
"C:\Users\Admin\AppData\Local\Temp\rAwb8457108962.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\rAwb8457108962.exe
  "C:\Users\Admin\AppData\Local\Temp\rAwb8457108962.exe"
  2⤵
  PID:1324
- C:\Users\Admin\AppData\Local\Temp\rAwb8457108962.exe
  "C:\Users\Admin\AppData\Local\Temp\rAwb8457108962.exe"
  2⤵
  PID:596
- C:\Users\Admin\AppData\Local\Temp\rAwb8457108962.exe
  "C:\Users\Admin\AppData\Local\Temp\rAwb8457108962.exe"
  2⤵
  PID:524
- C:\Users\Admin\AppData\Local\Temp\rAwb8457108962.exe
  "C:\Users\Admin\AppData\Local\Temp\rAwb8457108962.exe"
  2⤵
  PID:764
- C:\Users\Admin\AppData\Local\Temp\rAwb8457108962.exe
  "C:\Users\Admin\AppData\Local\Temp\rAwb8457108962.exe"
  2⤵
  PID:964

memory/2020-54-0x0000000000390000-0x0000000000462000-memory.dmp

Download

memory/2020-55-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Download

memory/2020-56-0x0000000000610000-0x0000000000626000-memory.dmp

Download

memory/2020-57-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Download

memory/2020-58-0x0000000000630000-0x000000000063C000-memory.dmp

Download

memory/2020-59-0x00000000054B0000-0x000000000555C000-memory.dmp

Download

memory/2020-60-0x0000000002060000-0x0000000002094000-memory.dmp

Download