c269b1931db163462343d0ecd8ef501e35e4da91c91f1464c8d526ef07a041bd

Analysis

max time kernel
55s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/03/2023, 16:26

Target

QUOTATION _RFQ# 1043999.exe
Size

1.1MB
MD5

e434e422d6bb9bc02f9a4be0b1c41d1b
SHA1

af7347b789fb43b26a83f4864e50eedf7f62095e
SHA256

c269b1931db163462343d0ecd8ef501e35e4da91c91f1464c8d526ef07a041bd
SHA512

72ffed26dfa5617a70852e88d8058d6adebcbd771bc3f0102f8fcf9bdddcac2264b37d07b5fd4790c177ad87f81fce0253ff9fc85c22f8034c066e66df657552
SSDEEP

24576:nVlj9vY9URDvRtWBQDtty/ziBgqMSAqzQYkYJrrzZL:nVB9g9YDptWuryduIA1L

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	QUOTATION _RFQ# 1043999.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 908	1320	QUOTATION _RFQ# 1043999.exe	28
PID 1320 wrote to memory of 908	1320	QUOTATION _RFQ# 1043999.exe	28
PID 1320 wrote to memory of 908	1320	QUOTATION _RFQ# 1043999.exe	28
PID 1320 wrote to memory of 908	1320	QUOTATION _RFQ# 1043999.exe	28
PID 1320 wrote to memory of 1500	1320	QUOTATION _RFQ# 1043999.exe	29
PID 1320 wrote to memory of 1500	1320	QUOTATION _RFQ# 1043999.exe	29
PID 1320 wrote to memory of 1500	1320	QUOTATION _RFQ# 1043999.exe	29
PID 1320 wrote to memory of 1500	1320	QUOTATION _RFQ# 1043999.exe	29
PID 1320 wrote to memory of 1652	1320	QUOTATION _RFQ# 1043999.exe	30
PID 1320 wrote to memory of 1652	1320	QUOTATION _RFQ# 1043999.exe	30
PID 1320 wrote to memory of 1652	1320	QUOTATION _RFQ# 1043999.exe	30
PID 1320 wrote to memory of 1652	1320	QUOTATION _RFQ# 1043999.exe	30
PID 1320 wrote to memory of 600	1320	QUOTATION _RFQ# 1043999.exe	31
PID 1320 wrote to memory of 600	1320	QUOTATION _RFQ# 1043999.exe	31
PID 1320 wrote to memory of 600	1320	QUOTATION _RFQ# 1043999.exe	31
PID 1320 wrote to memory of 600	1320	QUOTATION _RFQ# 1043999.exe	31
PID 1320 wrote to memory of 320	1320	QUOTATION _RFQ# 1043999.exe	32
PID 1320 wrote to memory of 320	1320	QUOTATION _RFQ# 1043999.exe	32
PID 1320 wrote to memory of 320	1320	QUOTATION _RFQ# 1043999.exe	32
PID 1320 wrote to memory of 320	1320	QUOTATION _RFQ# 1043999.exe	32

C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
  2⤵
  PID:908
- C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
  2⤵
  PID:1500
- C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
  2⤵
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
  2⤵
  PID:600
- C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
  2⤵
  PID:320

memory/1320-54-0x00000000003C0000-0x00000000004D8000-memory.dmp

Filesize
1.1MB

Download
memory/1320-55-0x0000000004C50000-0x0000000004C90000-memory.dmp

Filesize
256KB

Download
memory/1320-56-0x0000000000790000-0x00000000007A2000-memory.dmp

Filesize
72KB

Download
memory/1320-57-0x0000000004C50000-0x0000000004C90000-memory.dmp

Filesize
256KB

Download
memory/1320-58-0x00000000007A0000-0x00000000007AC000-memory.dmp

Filesize
48KB

Download
memory/1320-59-0x0000000005740000-0x000000000582A000-memory.dmp

Filesize
936KB

Download
memory/1320-60-0x0000000004DA0000-0x0000000004E16000-memory.dmp

Filesize
472KB

Download