9be9fe04682e95917bfedaa99c68a359b8214846cc5a3ee49e6ea8e17a6315d7

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 08:00

Target

dukasjen587138.exe
Size

517KB
MD5

00c5c676a4111a532eed4e0bd5f0864d
SHA1

20d970f8f837ec2025b49bfee094614c49aee8ab
SHA256

9be9fe04682e95917bfedaa99c68a359b8214846cc5a3ee49e6ea8e17a6315d7
SHA512

3c53b89a7c36ca75f31bebdf46fe8ecf09c6843b688a5adb7273ecf0a8ae1e6c4655b306aceff148aec2eb1bc41cf6ddaca74a6272a66da5dea079207df18b48
SSDEEP

12288:pfb/WT4UkuZbjWgNB7K2em7dGlRXCGdyUJpInSXjWWfyx56FzWdbjyJ:pfzW/ZbjPN/5Glpvy4guro568F+J

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	dukasjen587138.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2144	1656	dukasjen587138.exe	30
PID 1656 wrote to memory of 2144	1656	dukasjen587138.exe	30
PID 1656 wrote to memory of 2144	1656	dukasjen587138.exe	30
PID 1656 wrote to memory of 2144	1656	dukasjen587138.exe	30
PID 1656 wrote to memory of 2288	1656	dukasjen587138.exe	31
PID 1656 wrote to memory of 2288	1656	dukasjen587138.exe	31
PID 1656 wrote to memory of 2288	1656	dukasjen587138.exe	31
PID 1656 wrote to memory of 2288	1656	dukasjen587138.exe	31
PID 1656 wrote to memory of 2300	1656	dukasjen587138.exe	32
PID 1656 wrote to memory of 2300	1656	dukasjen587138.exe	32
PID 1656 wrote to memory of 2300	1656	dukasjen587138.exe	32
PID 1656 wrote to memory of 2300	1656	dukasjen587138.exe	32
PID 1656 wrote to memory of 2220	1656	dukasjen587138.exe	33
PID 1656 wrote to memory of 2220	1656	dukasjen587138.exe	33
PID 1656 wrote to memory of 2220	1656	dukasjen587138.exe	33
PID 1656 wrote to memory of 2220	1656	dukasjen587138.exe	33
PID 1656 wrote to memory of 2348	1656	dukasjen587138.exe	34
PID 1656 wrote to memory of 2348	1656	dukasjen587138.exe	34
PID 1656 wrote to memory of 2348	1656	dukasjen587138.exe	34
PID 1656 wrote to memory of 2348	1656	dukasjen587138.exe	34

C:\Users\Admin\AppData\Local\Temp\dukasjen587138.exe
"C:\Users\Admin\AppData\Local\Temp\dukasjen587138.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\dukasjen587138.exe
  "C:\Users\Admin\AppData\Local\Temp\dukasjen587138.exe"
  2⤵
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\dukasjen587138.exe
  "C:\Users\Admin\AppData\Local\Temp\dukasjen587138.exe"
  2⤵
  PID:2288
- C:\Users\Admin\AppData\Local\Temp\dukasjen587138.exe
  "C:\Users\Admin\AppData\Local\Temp\dukasjen587138.exe"
  2⤵
  PID:2300
- C:\Users\Admin\AppData\Local\Temp\dukasjen587138.exe
  "C:\Users\Admin\AppData\Local\Temp\dukasjen587138.exe"
  2⤵
  PID:2220
- C:\Users\Admin\AppData\Local\Temp\dukasjen587138.exe
  "C:\Users\Admin\AppData\Local\Temp\dukasjen587138.exe"
  2⤵
  PID:2348

memory/1656-53-0x0000000000380000-0x0000000000406000-memory.dmp

Filesize
536KB

Download
memory/1656-54-0x00000000741C0000-0x00000000748AE000-memory.dmp

Filesize
6.9MB

Download
memory/1656-55-0x0000000004C50000-0x0000000004C90000-memory.dmp

Filesize
256KB

Download
memory/1656-56-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/1656-57-0x00000000741C0000-0x00000000748AE000-memory.dmp

Filesize
6.9MB

Download
memory/1656-58-0x0000000004C50000-0x0000000004C90000-memory.dmp

Filesize
256KB

Download
memory/1656-59-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/1656-60-0x00000000052D0000-0x000000000532A000-memory.dmp

Filesize
360KB

Download
memory/1656-61-0x00000000741C0000-0x00000000748AE000-memory.dmp

Filesize
6.9MB

Download