20ee2801106d4ff80f2b5147544e837a941240cc5b54d4fe026bc16c07c1e516

Analysis

max time kernel
45s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-05-2023 01:49

Target

Request for Quotation.exe
Size

1.5MB
MD5

67683d83541b578498d12ddc5828260e
SHA1

679904b6c6101f399811885b42e98c4c8c564e6e
SHA256

9a3e3d21954d44054b67a726ecc1c6e54a231f4accc013fa91d0830ccf134680
SHA512

fb3080919598e0bedaa3b429e86f498bbbfcfb257a9c92dc9f6c197e2da9bd17328cc762bd97e7cbb770f0d6f1e8c8c05107a59f6204ce8ebc5ad4996e8e709b
SSDEEP

24576:sLOOmjfJ7uGyhgAzbOQ31ubRVTkK09CDg2bCaUwFDyfCTdNuuVIF/gwqb+:sG17uGmPOQ3oNVTkhC/bCaUwpy2wuV32

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	Request for Quotation.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 532	2032	Request for Quotation.exe	28
PID 2032 wrote to memory of 532	2032	Request for Quotation.exe	28
PID 2032 wrote to memory of 532	2032	Request for Quotation.exe	28
PID 2032 wrote to memory of 532	2032	Request for Quotation.exe	28
PID 2032 wrote to memory of 648	2032	Request for Quotation.exe	29
PID 2032 wrote to memory of 648	2032	Request for Quotation.exe	29
PID 2032 wrote to memory of 648	2032	Request for Quotation.exe	29
PID 2032 wrote to memory of 648	2032	Request for Quotation.exe	29
PID 2032 wrote to memory of 1152	2032	Request for Quotation.exe	30
PID 2032 wrote to memory of 1152	2032	Request for Quotation.exe	30
PID 2032 wrote to memory of 1152	2032	Request for Quotation.exe	30
PID 2032 wrote to memory of 1152	2032	Request for Quotation.exe	30
PID 2032 wrote to memory of 1148	2032	Request for Quotation.exe	31
PID 2032 wrote to memory of 1148	2032	Request for Quotation.exe	31
PID 2032 wrote to memory of 1148	2032	Request for Quotation.exe	31
PID 2032 wrote to memory of 1148	2032	Request for Quotation.exe	31
PID 2032 wrote to memory of 1952	2032	Request for Quotation.exe	32
PID 2032 wrote to memory of 1952	2032	Request for Quotation.exe	32
PID 2032 wrote to memory of 1952	2032	Request for Quotation.exe	32
PID 2032 wrote to memory of 1952	2032	Request for Quotation.exe	32

C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
  2⤵
  PID:532
- C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
  2⤵
  PID:648
- C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
  2⤵
  PID:1152
- C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
  2⤵
  PID:1148
- C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
  2⤵
  PID:1952

memory/2032-54-0x0000000000140000-0x00000000002BC000-memory.dmp

Filesize
1.5MB

Download
memory/2032-55-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2032-56-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/2032-57-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2032-58-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download
memory/2032-59-0x0000000005990000-0x0000000005AC8000-memory.dmp

Filesize
1.2MB

Download
memory/2032-60-0x0000000009E90000-0x000000000A040000-memory.dmp

Filesize
1.7MB

Download