f266e9833cf991a972db594ad7afad2332dfccdd2b7454e49455b759f406bcd2

Analysis

max time kernel
52s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-04-2023 22:22

Target

TT copy.exe
Size

1.6MB
MD5

3acff0b9068df07116870bf461f4f7c1
SHA1

fb7c0e6fcee327e8ed755e8f1c5199f35a3c4723
SHA256

f266e9833cf991a972db594ad7afad2332dfccdd2b7454e49455b759f406bcd2
SHA512

0bf707bc83a739e6ed63a56b76323db9c59fd6a3bfb05c760adc77cf918efddf1d9d4769bc14fc5846e0c1d836e3cefc8169778d8c0182e20a0a368e80c6494d
SSDEEP

49152:zxy+4OponS7iO7PYPhR/vNv1YWsWXLbZG8T0Zh591z:MKpoq57+/tztXLbZJGT

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	TT copy.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 976	1700	TT copy.exe	28
PID 1700 wrote to memory of 976	1700	TT copy.exe	28
PID 1700 wrote to memory of 976	1700	TT copy.exe	28
PID 1700 wrote to memory of 976	1700	TT copy.exe	28
PID 1700 wrote to memory of 1968	1700	TT copy.exe	29
PID 1700 wrote to memory of 1968	1700	TT copy.exe	29
PID 1700 wrote to memory of 1968	1700	TT copy.exe	29
PID 1700 wrote to memory of 1968	1700	TT copy.exe	29
PID 1700 wrote to memory of 1280	1700	TT copy.exe	30
PID 1700 wrote to memory of 1280	1700	TT copy.exe	30
PID 1700 wrote to memory of 1280	1700	TT copy.exe	30
PID 1700 wrote to memory of 1280	1700	TT copy.exe	30
PID 1700 wrote to memory of 1964	1700	TT copy.exe	31
PID 1700 wrote to memory of 1964	1700	TT copy.exe	31
PID 1700 wrote to memory of 1964	1700	TT copy.exe	31
PID 1700 wrote to memory of 1964	1700	TT copy.exe	31
PID 1700 wrote to memory of 524	1700	TT copy.exe	32
PID 1700 wrote to memory of 524	1700	TT copy.exe	32
PID 1700 wrote to memory of 524	1700	TT copy.exe	32
PID 1700 wrote to memory of 524	1700	TT copy.exe	32

C:\Users\Admin\AppData\Local\Temp\TT copy.exe
"C:\Users\Admin\AppData\Local\Temp\TT copy.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\TT copy.exe
  "C:\Users\Admin\AppData\Local\Temp\TT copy.exe"
  2⤵
  PID:976
- C:\Users\Admin\AppData\Local\Temp\TT copy.exe
  "C:\Users\Admin\AppData\Local\Temp\TT copy.exe"
  2⤵
  PID:1968
- C:\Users\Admin\AppData\Local\Temp\TT copy.exe
  "C:\Users\Admin\AppData\Local\Temp\TT copy.exe"
  2⤵
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\TT copy.exe
  "C:\Users\Admin\AppData\Local\Temp\TT copy.exe"
  2⤵
  PID:1964
- C:\Users\Admin\AppData\Local\Temp\TT copy.exe
  "C:\Users\Admin\AppData\Local\Temp\TT copy.exe"
  2⤵
  PID:524

memory/1700-54-0x00000000001B0000-0x000000000035C000-memory.dmp

Filesize
1.7MB

Download
memory/1700-55-0x0000000001F80000-0x0000000001FC0000-memory.dmp

Filesize
256KB

Download
memory/1700-56-0x0000000001FF0000-0x0000000002002000-memory.dmp

Filesize
72KB

Download
memory/1700-57-0x00000000020A0000-0x00000000020AC000-memory.dmp

Filesize
48KB

Download
memory/1700-58-0x0000000005E30000-0x0000000005F68000-memory.dmp

Filesize
1.2MB

Download
memory/1700-59-0x000000000A4E0000-0x000000000A690000-memory.dmp

Filesize
1.7MB

Download