698d902b9552dad46b248acb1c6674a53ac14d7e90764f7d0a70f02e636cebeb

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26-08-2023 08:31

Target

ed75cea904ef453eef6c9920ce3c93b5.exe
Size

538KB
MD5

ed75cea904ef453eef6c9920ce3c93b5
SHA1

c4413aa90f798fef7c178790599f9d3e64d6e614
SHA256

698d902b9552dad46b248acb1c6674a53ac14d7e90764f7d0a70f02e636cebeb
SHA512

a18d9dec591b0643497490b1b727a7ad9c83718bfde383356151c7142dec9996c4b5ea2b67e311778c872f051cb23a30349a463978f959efc4b6e0f8be307287
SSDEEP

12288:NbXdzhaf9b+sDwHsI0Z/xPs0gKTD2160PKe+QZpBG:nVafZ+QQsI03Ps0XTD6rTA

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2212	ed75cea904ef453eef6c9920ce3c93b5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	ed75cea904ef453eef6c9920ce3c93b5.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2184	2212	ed75cea904ef453eef6c9920ce3c93b5.exe	28
PID 2212 wrote to memory of 2184	2212	ed75cea904ef453eef6c9920ce3c93b5.exe	28
PID 2212 wrote to memory of 2184	2212	ed75cea904ef453eef6c9920ce3c93b5.exe	28
PID 2212 wrote to memory of 2184	2212	ed75cea904ef453eef6c9920ce3c93b5.exe	28
PID 2212 wrote to memory of 2184	2212	ed75cea904ef453eef6c9920ce3c93b5.exe	28
PID 2212 wrote to memory of 2184	2212	ed75cea904ef453eef6c9920ce3c93b5.exe	28
PID 2212 wrote to memory of 2184	2212	ed75cea904ef453eef6c9920ce3c93b5.exe	28

C:\Users\Admin\AppData\Local\Temp\ed75cea904ef453eef6c9920ce3c93b5.exe
"C:\Users\Admin\AppData\Local\Temp\ed75cea904ef453eef6c9920ce3c93b5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2184

memory/2212-0-0x0000000000130000-0x00000000001BA000-memory.dmp

Filesize
552KB

Download
memory/2212-1-0x000007FEF5920000-0x000007FEF630C000-memory.dmp

Filesize
9.9MB

Download
memory/2212-2-0x000000001AF30000-0x000000001AFB0000-memory.dmp

Filesize
512KB

Download
memory/2212-3-0x000000001A6E0000-0x000000001A768000-memory.dmp

Filesize
544KB

Download
memory/2212-5-0x000007FEF5920000-0x000007FEF630C000-memory.dmp

Filesize
9.9MB

Download