b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e

Analysis

max time kernel
45s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
01/07/2023, 06:27

Target

1232exe.exe
Size

827KB
MD5

a1ce7b26712e1db177d86fa87d09c354
SHA1

23d567e5ee4d4bf882f5d4ebe54643eecd921ef4
SHA256

b6b0ac3d7e4ef3a97fb470b38e53f3d8114b736b60408d9828cd5f81e2d7cf0e
SHA512

e5d5c4770131274c28dab0adbac3ed84395aca30a8c15f7004cd4d28ae503c507dacb432dcce65b2f004711837b3cd7a26766b028957aa3a8bc2d99f9dd849d4
SSDEEP

12288:IKY7z5GoJiGaq5auxKSjipNvJDK2WSqcIVr4vo1euUTyH2BQMyEp0mpefJ3Lww:G5GoR5amjipNvFK2LXG3VrEuqqJ8w

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	1232exe.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1804	932	1232exe.exe	28
PID 932 wrote to memory of 1804	932	1232exe.exe	28
PID 932 wrote to memory of 1804	932	1232exe.exe	28
PID 932 wrote to memory of 1804	932	1232exe.exe	28
PID 932 wrote to memory of 1764	932	1232exe.exe	29
PID 932 wrote to memory of 1764	932	1232exe.exe	29
PID 932 wrote to memory of 1764	932	1232exe.exe	29
PID 932 wrote to memory of 1764	932	1232exe.exe	29
PID 932 wrote to memory of 1900	932	1232exe.exe	30
PID 932 wrote to memory of 1900	932	1232exe.exe	30
PID 932 wrote to memory of 1900	932	1232exe.exe	30
PID 932 wrote to memory of 1900	932	1232exe.exe	30
PID 932 wrote to memory of 584	932	1232exe.exe	31
PID 932 wrote to memory of 584	932	1232exe.exe	31
PID 932 wrote to memory of 584	932	1232exe.exe	31
PID 932 wrote to memory of 584	932	1232exe.exe	31
PID 932 wrote to memory of 1160	932	1232exe.exe	32
PID 932 wrote to memory of 1160	932	1232exe.exe	32
PID 932 wrote to memory of 1160	932	1232exe.exe	32
PID 932 wrote to memory of 1160	932	1232exe.exe	32

C:\Users\Admin\AppData\Local\Temp\1232exe.exe
"C:\Users\Admin\AppData\Local\Temp\1232exe.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\1232exe.exe
  "C:\Users\Admin\AppData\Local\Temp\1232exe.exe"
  2⤵
  PID:1804
- C:\Users\Admin\AppData\Local\Temp\1232exe.exe
  "C:\Users\Admin\AppData\Local\Temp\1232exe.exe"
  2⤵
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\1232exe.exe
  "C:\Users\Admin\AppData\Local\Temp\1232exe.exe"
  2⤵
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\1232exe.exe
  "C:\Users\Admin\AppData\Local\Temp\1232exe.exe"
  2⤵
  PID:584
- C:\Users\Admin\AppData\Local\Temp\1232exe.exe
  "C:\Users\Admin\AppData\Local\Temp\1232exe.exe"
  2⤵
  PID:1160

memory/932-54-0x00000000003F0000-0x00000000004C6000-memory.dmp

Filesize
856KB

Download
memory/932-55-0x0000000004A60000-0x0000000004AA0000-memory.dmp

Filesize
256KB

Download
memory/932-56-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/932-57-0x0000000004A60000-0x0000000004AA0000-memory.dmp

Filesize
256KB

Download
memory/932-58-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download
memory/932-59-0x0000000005230000-0x00000000052C0000-memory.dmp

Filesize
576KB

Download
memory/932-60-0x0000000005C30000-0x0000000005C8C000-memory.dmp

Filesize
368KB

Download