e3e6d851f1598eb145492e46d7431f72436178f1a60ebc4d6742839e12d52200

Analysis

max time kernel
46s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18-05-2023 06:18

Target

TT.jpg.exe
Size

578KB
MD5

dcd4d61ffaef32a296e43c089fbc340b
SHA1

d7fa3b15e6716a22baf438b59ca1ed0ecafca8c2
SHA256

e3e6d851f1598eb145492e46d7431f72436178f1a60ebc4d6742839e12d52200
SHA512

816c7e614d7532eea43aa11aca1af8e9e02732424fb2fb2a2f406ab3f3680a7e0156816714a35509c1eb51095a44b9f32c70f8a50d3171bcb7baba04e977d04d
SSDEEP

12288:QZagnkpPSpsTweRcLGmDvqBMvTCNnYE+I:Q0e+2teCLGYvTvbE+I

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	TT.jpg.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1044	1376	TT.jpg.exe	27
PID 1376 wrote to memory of 1044	1376	TT.jpg.exe	27
PID 1376 wrote to memory of 1044	1376	TT.jpg.exe	27
PID 1376 wrote to memory of 1044	1376	TT.jpg.exe	27
PID 1376 wrote to memory of 1480	1376	TT.jpg.exe	28
PID 1376 wrote to memory of 1480	1376	TT.jpg.exe	28
PID 1376 wrote to memory of 1480	1376	TT.jpg.exe	28
PID 1376 wrote to memory of 1480	1376	TT.jpg.exe	28
PID 1376 wrote to memory of 520	1376	TT.jpg.exe	29
PID 1376 wrote to memory of 520	1376	TT.jpg.exe	29
PID 1376 wrote to memory of 520	1376	TT.jpg.exe	29
PID 1376 wrote to memory of 520	1376	TT.jpg.exe	29
PID 1376 wrote to memory of 2004	1376	TT.jpg.exe	30
PID 1376 wrote to memory of 2004	1376	TT.jpg.exe	30
PID 1376 wrote to memory of 2004	1376	TT.jpg.exe	30
PID 1376 wrote to memory of 2004	1376	TT.jpg.exe	30
PID 1376 wrote to memory of 668	1376	TT.jpg.exe	31
PID 1376 wrote to memory of 668	1376	TT.jpg.exe	31
PID 1376 wrote to memory of 668	1376	TT.jpg.exe	31
PID 1376 wrote to memory of 668	1376	TT.jpg.exe	31

C:\Users\Admin\AppData\Local\Temp\TT.jpg.exe
"C:\Users\Admin\AppData\Local\Temp\TT.jpg.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\TT.jpg.exe
  "C:\Users\Admin\AppData\Local\Temp\TT.jpg.exe"
  2⤵
  PID:1044
- C:\Users\Admin\AppData\Local\Temp\TT.jpg.exe
  "C:\Users\Admin\AppData\Local\Temp\TT.jpg.exe"
  2⤵
  PID:1480
- C:\Users\Admin\AppData\Local\Temp\TT.jpg.exe
  "C:\Users\Admin\AppData\Local\Temp\TT.jpg.exe"
  2⤵
  PID:520
- C:\Users\Admin\AppData\Local\Temp\TT.jpg.exe
  "C:\Users\Admin\AppData\Local\Temp\TT.jpg.exe"
  2⤵
  PID:2004
- C:\Users\Admin\AppData\Local\Temp\TT.jpg.exe
  "C:\Users\Admin\AppData\Local\Temp\TT.jpg.exe"
  2⤵
  PID:668

memory/1376-54-0x0000000000370000-0x0000000000406000-memory.dmp

Filesize
600KB

Download
memory/1376-55-0x0000000000610000-0x0000000000650000-memory.dmp

Filesize
256KB

Download
memory/1376-56-0x0000000000230000-0x000000000023E000-memory.dmp

Filesize
56KB

Download
memory/1376-57-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/1376-58-0x0000000004D60000-0x0000000004DBA000-memory.dmp

Filesize
360KB

Download
memory/1376-59-0x0000000002060000-0x0000000002082000-memory.dmp

Filesize
136KB

Download