3f7098a7d18bb2aa2eae456f5d14592c46f53e28287fd9bf9a9fc253f8692ddf

Analysis

max time kernel
48s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29/04/2023, 01:56

Target
Order.exe
Size 838KB
Sample230429-ccn8bsbb9v
SHA256 3f7098a7d18bb2aa2eae456f5d14592c46f53e28287fd9bf9a9fc253f8692ddf
MD5 4a4b476a512c60c92e92aa2afa3ef7a7
SHA1 083a3e656c8962b1e6bce8f19ef314046fbfed7d
SHA512 1a72f7e606b5dcc253afd18e7f1fe5f6e1b98d179d0f28993888fb43fbb12a1034c97cb50ec659c663285eadf6f28554dc88759cd2885f7b483c818d4d787e02
SSDEEP 12288:Yv/9WflU/9D5X/+j5THrFmIcegLBh8ds/2yyH5097qBuEuax6Ykr:MylUXXGj57r3ceSh6rx5y7suEu5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	Order.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1216	836	Order.exe	28
PID 836 wrote to memory of 1216	836	Order.exe	28
PID 836 wrote to memory of 1216	836	Order.exe	28
PID 836 wrote to memory of 1216	836	Order.exe	28
PID 836 wrote to memory of 1476	836	Order.exe	29
PID 836 wrote to memory of 1476	836	Order.exe	29
PID 836 wrote to memory of 1476	836	Order.exe	29
PID 836 wrote to memory of 1476	836	Order.exe	29
PID 836 wrote to memory of 1484	836	Order.exe	30
PID 836 wrote to memory of 1484	836	Order.exe	30
PID 836 wrote to memory of 1484	836	Order.exe	30
PID 836 wrote to memory of 1484	836	Order.exe	30
PID 836 wrote to memory of 580	836	Order.exe	31
PID 836 wrote to memory of 580	836	Order.exe	31
PID 836 wrote to memory of 580	836	Order.exe	31
PID 836 wrote to memory of 580	836	Order.exe	31
PID 836 wrote to memory of 472	836	Order.exe	32
PID 836 wrote to memory of 472	836	Order.exe	32
PID 836 wrote to memory of 472	836	Order.exe	32
PID 836 wrote to memory of 472	836	Order.exe	32

C:\Users\Admin\AppData\Local\Temp\Order.exe
"C:\Users\Admin\AppData\Local\Temp\Order.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836
- C:\Users\Admin\AppData\Local\Temp\Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Order.exe"
  2⤵
  PID:1216
- C:\Users\Admin\AppData\Local\Temp\Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Order.exe"
  2⤵
  PID:1476
- C:\Users\Admin\AppData\Local\Temp\Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Order.exe"
  2⤵
  PID:1484
- C:\Users\Admin\AppData\Local\Temp\Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Order.exe"
  2⤵
  PID:580
- C:\Users\Admin\AppData\Local\Temp\Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Order.exe"
  2⤵
  PID:472

memory/836-54-0x00000000003B0000-0x0000000000488000-memory.dmp

Download

memory/836-55-0x0000000004C20000-0x0000000004C60000-memory.dmp

Download

memory/836-56-0x0000000000650000-0x0000000000662000-memory.dmp

Download

memory/836-57-0x0000000004C20000-0x0000000004C60000-memory.dmp

Download

memory/836-58-0x00000000009F0000-0x00000000009FC000-memory.dmp

Download

memory/836-59-0x0000000005100000-0x000000000516C000-memory.dmp

Download

memory/836-60-0x00000000044E0000-0x0000000004512000-memory.dmp

Download