856afd89ee07b6f8be9906cb827c0cc407a6be6f19925f77e76fedaf512e5305

Analysis

max time kernel
45s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/05/2023, 06:53

Target

8840414a8ba647e57aeadfa3fc8edbd4.exe
Size

546KB
MD5

8840414a8ba647e57aeadfa3fc8edbd4
SHA1

fdc4e15fbfd34a2a880a6f34a4d6c79b39c9b832
SHA256

856afd89ee07b6f8be9906cb827c0cc407a6be6f19925f77e76fedaf512e5305
SHA512

7f1ee12485edd3a9bd72719302f5ac16aed220268df1bc016b0ee93714ec9abd063024c3f229d9a19a45e5afdbf082681157555497fff88df34ec21aefb5b1b8
SSDEEP

12288:F2z5jMGDZQbYQO3mZbjakp3pKdiixtTdzJ0RCL:A5jMr0QOgPl3pQiGtT1ug

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 560	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	28
PID 1260 wrote to memory of 560	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	28
PID 1260 wrote to memory of 560	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	28
PID 1260 wrote to memory of 560	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	28
PID 1260 wrote to memory of 1168	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	29
PID 1260 wrote to memory of 1168	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	29
PID 1260 wrote to memory of 1168	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	29
PID 1260 wrote to memory of 1168	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	29
PID 1260 wrote to memory of 660	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	30
PID 1260 wrote to memory of 660	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	30
PID 1260 wrote to memory of 660	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	30
PID 1260 wrote to memory of 660	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	30
PID 1260 wrote to memory of 268	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	31
PID 1260 wrote to memory of 268	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	31
PID 1260 wrote to memory of 268	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	31
PID 1260 wrote to memory of 268	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	31
PID 1260 wrote to memory of 760	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	32
PID 1260 wrote to memory of 760	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	32
PID 1260 wrote to memory of 760	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	32
PID 1260 wrote to memory of 760	1260	8840414a8ba647e57aeadfa3fc8edbd4.exe	32

C:\Users\Admin\AppData\Local\Temp\8840414a8ba647e57aeadfa3fc8edbd4.exe
"C:\Users\Admin\AppData\Local\Temp\8840414a8ba647e57aeadfa3fc8edbd4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\8840414a8ba647e57aeadfa3fc8edbd4.exe
  "C:\Users\Admin\AppData\Local\Temp\8840414a8ba647e57aeadfa3fc8edbd4.exe"
  2⤵
  PID:560
- C:\Users\Admin\AppData\Local\Temp\8840414a8ba647e57aeadfa3fc8edbd4.exe
  "C:\Users\Admin\AppData\Local\Temp\8840414a8ba647e57aeadfa3fc8edbd4.exe"
  2⤵
  PID:1168
- C:\Users\Admin\AppData\Local\Temp\8840414a8ba647e57aeadfa3fc8edbd4.exe
  "C:\Users\Admin\AppData\Local\Temp\8840414a8ba647e57aeadfa3fc8edbd4.exe"
  2⤵
  PID:660
- C:\Users\Admin\AppData\Local\Temp\8840414a8ba647e57aeadfa3fc8edbd4.exe
  "C:\Users\Admin\AppData\Local\Temp\8840414a8ba647e57aeadfa3fc8edbd4.exe"
  2⤵
  PID:268
- C:\Users\Admin\AppData\Local\Temp\8840414a8ba647e57aeadfa3fc8edbd4.exe
  "C:\Users\Admin\AppData\Local\Temp\8840414a8ba647e57aeadfa3fc8edbd4.exe"
  2⤵
  PID:760

memory/1260-54-0x00000000000F0000-0x000000000017E000-memory.dmp

Filesize
568KB

Download
memory/1260-55-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/1260-56-0x00000000002C0000-0x00000000002CE000-memory.dmp

Filesize
56KB

Download
memory/1260-57-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/1260-58-0x0000000000430000-0x000000000043A000-memory.dmp

Filesize
40KB

Download
memory/1260-59-0x0000000004C50000-0x0000000004CAA000-memory.dmp

Filesize
360KB

Download
memory/1260-60-0x0000000000810000-0x0000000000832000-memory.dmp

Filesize
136KB

Download