551af39d6b0f2a184a1130213726b032fb7e0cb40f622cd9a64cbfc32ffad521

Analysis

max time kernel
46s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-05-2023 17:07

Target

Request for Quotation.exe
Size

1.5MB
MD5

67683d83541b578498d12ddc5828260e
SHA1

679904b6c6101f399811885b42e98c4c8c564e6e
SHA256

9a3e3d21954d44054b67a726ecc1c6e54a231f4accc013fa91d0830ccf134680
SHA512

fb3080919598e0bedaa3b429e86f498bbbfcfb257a9c92dc9f6c197e2da9bd17328cc762bd97e7cbb770f0d6f1e8c8c05107a59f6204ce8ebc5ad4996e8e709b
SSDEEP

24576:sLOOmjfJ7uGyhgAzbOQ31ubRVTkK09CDg2bCaUwFDyfCTdNuuVIF/gwqb+:sG17uGmPOQ3oNVTkhC/bCaUwpy2wuV32

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	288	Request for Quotation.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1864	288	Request for Quotation.exe	28
PID 288 wrote to memory of 1864	288	Request for Quotation.exe	28
PID 288 wrote to memory of 1864	288	Request for Quotation.exe	28
PID 288 wrote to memory of 1864	288	Request for Quotation.exe	28
PID 288 wrote to memory of 652	288	Request for Quotation.exe	29
PID 288 wrote to memory of 652	288	Request for Quotation.exe	29
PID 288 wrote to memory of 652	288	Request for Quotation.exe	29
PID 288 wrote to memory of 652	288	Request for Quotation.exe	29
PID 288 wrote to memory of 1176	288	Request for Quotation.exe	30
PID 288 wrote to memory of 1176	288	Request for Quotation.exe	30
PID 288 wrote to memory of 1176	288	Request for Quotation.exe	30
PID 288 wrote to memory of 1176	288	Request for Quotation.exe	30
PID 288 wrote to memory of 1188	288	Request for Quotation.exe	31
PID 288 wrote to memory of 1188	288	Request for Quotation.exe	31
PID 288 wrote to memory of 1188	288	Request for Quotation.exe	31
PID 288 wrote to memory of 1188	288	Request for Quotation.exe	31
PID 288 wrote to memory of 1724	288	Request for Quotation.exe	32
PID 288 wrote to memory of 1724	288	Request for Quotation.exe	32
PID 288 wrote to memory of 1724	288	Request for Quotation.exe	32
PID 288 wrote to memory of 1724	288	Request for Quotation.exe	32

C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:288
- C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
  2⤵
  PID:1864
- C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
  2⤵
  PID:652
- C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
  2⤵
  PID:1176
- C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
  2⤵
  PID:1188
- C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
  2⤵
  PID:1724

memory/288-54-0x00000000003A0000-0x000000000051C000-memory.dmp

Filesize
1.5MB

Download
memory/288-55-0x0000000004F60000-0x0000000004FA0000-memory.dmp

Filesize
256KB

Download
memory/288-56-0x0000000000650000-0x0000000000662000-memory.dmp

Filesize
72KB

Download
memory/288-57-0x0000000004F60000-0x0000000004FA0000-memory.dmp

Filesize
256KB

Download
memory/288-58-0x0000000000670000-0x000000000067A000-memory.dmp

Filesize
40KB

Download
memory/288-59-0x0000000005860000-0x0000000005998000-memory.dmp

Filesize
1.2MB

Download
memory/288-60-0x0000000009EF0000-0x000000000A0A0000-memory.dmp

Filesize
1.7MB

Download