18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043

Analysis

max time kernel
51s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-05-2023 13:40

Target

Purchase Order 202319876.exe
Size

1.5MB
MD5

581f51fd35e943a69a4c569fa8654736
SHA1

610e7579a996ea788ccb688a9dda9d4855a40a2d
SHA256

18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043
SHA512

8bb8ce0f096c5a08e2457c7039f0169ae312f850e8189e240176e7a4ccf4ba113efe9f3a19e4e282ff66b60e48b0e07127270da804e0192f5ef091f7ea9e03db
SSDEEP

24576:Xbj8B+M73OglQfGmzu7SulbydbwcLxTDkU9tMMkB5lO2dMqtX1uP:XX++tglKKPwbwcLh4otmB7ldMg1C

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	Purchase Order 202319876.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1492	1300	Purchase Order 202319876.exe	26
PID 1300 wrote to memory of 1492	1300	Purchase Order 202319876.exe	26
PID 1300 wrote to memory of 1492	1300	Purchase Order 202319876.exe	26
PID 1300 wrote to memory of 1492	1300	Purchase Order 202319876.exe	26
PID 1300 wrote to memory of 576	1300	Purchase Order 202319876.exe	27
PID 1300 wrote to memory of 576	1300	Purchase Order 202319876.exe	27
PID 1300 wrote to memory of 576	1300	Purchase Order 202319876.exe	27
PID 1300 wrote to memory of 576	1300	Purchase Order 202319876.exe	27
PID 1300 wrote to memory of 532	1300	Purchase Order 202319876.exe	28
PID 1300 wrote to memory of 532	1300	Purchase Order 202319876.exe	28
PID 1300 wrote to memory of 532	1300	Purchase Order 202319876.exe	28
PID 1300 wrote to memory of 532	1300	Purchase Order 202319876.exe	28
PID 1300 wrote to memory of 740	1300	Purchase Order 202319876.exe	29
PID 1300 wrote to memory of 740	1300	Purchase Order 202319876.exe	29
PID 1300 wrote to memory of 740	1300	Purchase Order 202319876.exe	29
PID 1300 wrote to memory of 740	1300	Purchase Order 202319876.exe	29
PID 1300 wrote to memory of 1648	1300	Purchase Order 202319876.exe	30
PID 1300 wrote to memory of 1648	1300	Purchase Order 202319876.exe	30
PID 1300 wrote to memory of 1648	1300	Purchase Order 202319876.exe	30
PID 1300 wrote to memory of 1648	1300	Purchase Order 202319876.exe	30

C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"
  2⤵
  PID:1492
- C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"
  2⤵
  PID:576
- C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"
  2⤵
  PID:532
- C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"
  2⤵
  PID:740
- C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"
  2⤵
  PID:1648

memory/1300-54-0x00000000002F0000-0x000000000046E000-memory.dmp

Filesize
1.5MB

Download
memory/1300-55-0x0000000001F70000-0x0000000001FB0000-memory.dmp

Filesize
256KB

Download
memory/1300-56-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/1300-57-0x0000000001F70000-0x0000000001FB0000-memory.dmp

Filesize
256KB

Download
memory/1300-58-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/1300-59-0x0000000005D10000-0x0000000005E48000-memory.dmp

Filesize
1.2MB

Download
memory/1300-60-0x0000000001F70000-0x0000000001FB0000-memory.dmp

Filesize
256KB

Download
memory/1300-61-0x000000000A260000-0x000000000A410000-memory.dmp

Filesize
1.7MB

Download