fb27a8f334ce468be1c7085433fa4553df1ac2bdc84573183c1adb58a9f77727

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28/08/2023, 19:28

Target

Sign.exe
Size

10KB
MD5

b18f2b99d7ce903a148c7e546a26a748
SHA1

a6c45f978c21c1aed97e90c04372a92a86aaa31a
SHA256

fb27a8f334ce468be1c7085433fa4553df1ac2bdc84573183c1adb58a9f77727
SHA512

24674cce626deb0cee3872525d843b268ead1d23c203e477b03d98ca67d91918f6797c57fb0ac412b6f1707e21468626c463517a59fce3153c9b23106fe36075
SSDEEP

96:jwas6qGR9s5jfdQMKJ6PIMDoDyWSAQfdnurEkZvYYoesPQbKxup+zYYD/C7t:jwG19s5j26PDDoOhRulWY2PQGup+

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2464	Sign.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1268	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 1268	2464	Sign.exe	19
PID 1268 wrote to memory of 2484	1268	Explorer.EXE	29
PID 1268 wrote to memory of 2484	1268	Explorer.EXE	29
PID 1268 wrote to memory of 2484	1268	Explorer.EXE	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\Sign.exe
  "C:\Users\Admin\AppData\Local\Temp\Sign.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\1.bat
  2⤵
  PID:2484

memory/1268-0-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/1268-1-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/1268-3-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download