cc7cf8749904ae86070b62c4ba66f3049f0bb34b873b7b23ce674201c93ab177

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
28-06-2023 01:43

Target

239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2.exe
Size

335KB
MD5

b5237a3f0b1db945c1fe3f9ba71e3ff2
SHA1

ba302c3c2490a3b1b04cfbdd76097f2444a54700
SHA256

239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2
SHA512

9879c4cd6e995916cbd8cb16f6cb3982b48b0ffc5d01479e2c2f3f73ae46a5129893571f94ded70a0ad61a1340c67ef8214018bbc7e1e17fd5395a4f55fb78a1
SSDEEP

6144:d/sM+uEe4oleWZxrigxyZdXlgdqUh+LoXl4m34fX6Rs+j2exWLsxAFFDwkGklYkv:5sM+uEe30D67j2exWPFxwkiVi

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

844 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 844 powershell.exe

pid	process
844	powershell.exe

description	pid	process
Token: SeDebugPrivilege	844	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2.exe

description	pid	process	target process
PID 1664 wrote to memory of 844	1664	239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2.exe	powershell.exe
PID 1664 wrote to memory of 844	1664	239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2.exe	powershell.exe
PID 1664 wrote to memory of 844	1664	239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2.exe	powershell.exe
PID 1664 wrote to memory of 844	1664	239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2.exe
"C:\Users\Admin\AppData\Local\Temp\239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

memory/844-59-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/844-58-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/1664-54-0x0000000000D10000-0x0000000000D68000-memory.dmp

Filesize
352KB

Download
memory/1664-55-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/1664-60-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download