Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
12-06-2023 11:50
Behavioral task
behavioral1
Sample
09000799.exe
Resource
win7-20230220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
09000799.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
09000799.exe
-
Size
1.8MB
-
MD5
a8e21d0a395957079d29dab3f6d2f0c7
-
SHA1
4ded3b53f149f64298289d52a98288cc56a62005
-
SHA256
a9e2eb82a9248f900aa399ac902d78778d5391457c95e202f0e4331bf9b22b37
-
SHA512
0210430aeb6b98eed77c3cb58d25fe7948d1aa1074490d6f1799ab225e6e5ed5b9d0e6fface71332446b2b40faeb044138ea58c18530dee5bdb7aacc8f5eb046
-
SSDEEP
24576:xslcze89r3WOSPQud80RRp/8mUeUDSVXT5XLyaT7Y7gbaVD:te896Xou7Rz8mB5XT5XL1fYsbaV
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe 1604 09000799.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1604 09000799.exe