c269b1931db163462343d0ecd8ef501e35e4da91c91f1464c8d526ef07a041bd

Analysis

max time kernel
55s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/03/2023, 16:26

Target
QUOTATION _RFQ# 1043999.exe
Size 1.1MB
Sample230321-txj8jsbh76
SHA256 c269b1931db163462343d0ecd8ef501e35e4da91c91f1464c8d526ef07a041bd
MD5 e434e422d6bb9bc02f9a4be0b1c41d1b
SHA1 af7347b789fb43b26a83f4864e50eedf7f62095e
SHA512 72ffed26dfa5617a70852e88d8058d6adebcbd771bc3f0102f8fcf9bdddcac2264b37d07b5fd4790c177ad87f81fce0253ff9fc85c22f8034c066e66df657552
SSDEEP 24576:nVlj9vY9URDvRtWBQDtty/ziBgqMSAqzQYkYJrrzZL:nVB9g9YDptWuryduIA1L
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	QUOTATION _RFQ# 1043999.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 908	1320	QUOTATION _RFQ# 1043999.exe	28
PID 1320 wrote to memory of 908	1320	QUOTATION _RFQ# 1043999.exe	28
PID 1320 wrote to memory of 908	1320	QUOTATION _RFQ# 1043999.exe	28
PID 1320 wrote to memory of 908	1320	QUOTATION _RFQ# 1043999.exe	28
PID 1320 wrote to memory of 1500	1320	QUOTATION _RFQ# 1043999.exe	29
PID 1320 wrote to memory of 1500	1320	QUOTATION _RFQ# 1043999.exe	29
PID 1320 wrote to memory of 1500	1320	QUOTATION _RFQ# 1043999.exe	29
PID 1320 wrote to memory of 1500	1320	QUOTATION _RFQ# 1043999.exe	29
PID 1320 wrote to memory of 1652	1320	QUOTATION _RFQ# 1043999.exe	30
PID 1320 wrote to memory of 1652	1320	QUOTATION _RFQ# 1043999.exe	30
PID 1320 wrote to memory of 1652	1320	QUOTATION _RFQ# 1043999.exe	30
PID 1320 wrote to memory of 1652	1320	QUOTATION _RFQ# 1043999.exe	30
PID 1320 wrote to memory of 600	1320	QUOTATION _RFQ# 1043999.exe	31
PID 1320 wrote to memory of 600	1320	QUOTATION _RFQ# 1043999.exe	31
PID 1320 wrote to memory of 600	1320	QUOTATION _RFQ# 1043999.exe	31
PID 1320 wrote to memory of 600	1320	QUOTATION _RFQ# 1043999.exe	31
PID 1320 wrote to memory of 320	1320	QUOTATION _RFQ# 1043999.exe	32
PID 1320 wrote to memory of 320	1320	QUOTATION _RFQ# 1043999.exe	32
PID 1320 wrote to memory of 320	1320	QUOTATION _RFQ# 1043999.exe	32
PID 1320 wrote to memory of 320	1320	QUOTATION _RFQ# 1043999.exe	32

C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
  2⤵
  PID:908
- C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
  2⤵
  PID:1500
- C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
  2⤵
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
  2⤵
  PID:600
- C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
  2⤵
  PID:320

memory/1320-54-0x00000000003C0000-0x00000000004D8000-memory.dmp

Download

memory/1320-55-0x0000000004C50000-0x0000000004C90000-memory.dmp

Download

memory/1320-56-0x0000000000790000-0x00000000007A2000-memory.dmp

Download

memory/1320-57-0x0000000004C50000-0x0000000004C90000-memory.dmp

Download

memory/1320-58-0x00000000007A0000-0x00000000007AC000-memory.dmp

Download

memory/1320-59-0x0000000005740000-0x000000000582A000-memory.dmp

Download

memory/1320-60-0x0000000004DA0000-0x0000000004E16000-memory.dmp

Download