0f9109bc99a6c0cb299d1520099a8ca2d87d8ca4e1806fde417b60cf6dd233f9

Analysis

max time kernel
48s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-04-2023 10:41

Target

Purchase Order.exe
Size

882KB
MD5

80f8b83ff944f41eb4b301b1976946ec
SHA1

4766b46ebc3674f8198319d6ad164b04e6fe39b2
SHA256

0f9109bc99a6c0cb299d1520099a8ca2d87d8ca4e1806fde417b60cf6dd233f9
SHA512

417e941be626bb36baab3869c77133b8efeeca7d205bfb73ce5a433a459dc2b78e13945e39b3ecd01306b3027c6d53781b3f63debe42a8592e375e3719302e73
SSDEEP

24576:7/nche0sofbtJZf78cOk6K05Gr1Q5c5bv:7PchBJZf7FCGr1Q5Kb

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	Purchase Order.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 332	1240	Purchase Order.exe	27
PID 1240 wrote to memory of 332	1240	Purchase Order.exe	27
PID 1240 wrote to memory of 332	1240	Purchase Order.exe	27
PID 1240 wrote to memory of 332	1240	Purchase Order.exe	27
PID 1240 wrote to memory of 1560	1240	Purchase Order.exe	28
PID 1240 wrote to memory of 1560	1240	Purchase Order.exe	28
PID 1240 wrote to memory of 1560	1240	Purchase Order.exe	28
PID 1240 wrote to memory of 1560	1240	Purchase Order.exe	28
PID 1240 wrote to memory of 1512	1240	Purchase Order.exe	29
PID 1240 wrote to memory of 1512	1240	Purchase Order.exe	29
PID 1240 wrote to memory of 1512	1240	Purchase Order.exe	29
PID 1240 wrote to memory of 1512	1240	Purchase Order.exe	29
PID 1240 wrote to memory of 632	1240	Purchase Order.exe	30
PID 1240 wrote to memory of 632	1240	Purchase Order.exe	30
PID 1240 wrote to memory of 632	1240	Purchase Order.exe	30
PID 1240 wrote to memory of 632	1240	Purchase Order.exe	30
PID 1240 wrote to memory of 872	1240	Purchase Order.exe	31
PID 1240 wrote to memory of 872	1240	Purchase Order.exe	31
PID 1240 wrote to memory of 872	1240	Purchase Order.exe	31
PID 1240 wrote to memory of 872	1240	Purchase Order.exe	31

C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  PID:332
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  PID:1560
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  PID:1512
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  PID:632
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  PID:872

memory/1240-54-0x0000000000240000-0x0000000000322000-memory.dmp

Filesize
904KB

Download
memory/1240-55-0x00000000020E0000-0x0000000002120000-memory.dmp

Filesize
256KB

Download
memory/1240-56-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/1240-57-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/1240-58-0x0000000007E70000-0x0000000007F1C000-memory.dmp

Filesize
688KB

Download
memory/1240-59-0x0000000005DC0000-0x0000000005E36000-memory.dmp

Filesize
472KB

Download