49c64577ddf3ce2e1f43c7832736e395b7e205132dd13c42e58be6a769a50832

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/09/2023, 10:17

Target
Purchase Samples-404995.exe
Size 594KB
Sample230911-mbc4safe29
SHA256 49c64577ddf3ce2e1f43c7832736e395b7e205132dd13c42e58be6a769a50832
MD5 b444f067b6e84564db815accdf14d6fe
SHA1 2aca317851190a6d6ed9a61e3b20db9a879ec8e1
SHA512 42e78a7bb9d1174d6b3d6c967912c754ab7cfdbb869144efbd52876634d4026755b9d3051f957397dc25dadf8f7a553e630ce5b90042358ad0ae945f16d2b8fc
SSDEEP 12288:r5fVsbR2XSii82GG+qhz95kmbTdSrAC+fzLgb+LE:rtO2iiiP+qhz9OATd8ACwLgb+L
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	Purchase Samples-404995.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2572	2700	Purchase Samples-404995.exe	30
PID 2700 wrote to memory of 2572	2700	Purchase Samples-404995.exe	30
PID 2700 wrote to memory of 2572	2700	Purchase Samples-404995.exe	30
PID 2700 wrote to memory of 2572	2700	Purchase Samples-404995.exe	30
PID 2700 wrote to memory of 2576	2700	Purchase Samples-404995.exe	31
PID 2700 wrote to memory of 2576	2700	Purchase Samples-404995.exe	31
PID 2700 wrote to memory of 2576	2700	Purchase Samples-404995.exe	31
PID 2700 wrote to memory of 2576	2700	Purchase Samples-404995.exe	31
PID 2700 wrote to memory of 2632	2700	Purchase Samples-404995.exe	32
PID 2700 wrote to memory of 2632	2700	Purchase Samples-404995.exe	32
PID 2700 wrote to memory of 2632	2700	Purchase Samples-404995.exe	32
PID 2700 wrote to memory of 2632	2700	Purchase Samples-404995.exe	32
PID 2700 wrote to memory of 2636	2700	Purchase Samples-404995.exe	33
PID 2700 wrote to memory of 2636	2700	Purchase Samples-404995.exe	33
PID 2700 wrote to memory of 2636	2700	Purchase Samples-404995.exe	33
PID 2700 wrote to memory of 2636	2700	Purchase Samples-404995.exe	33
PID 2700 wrote to memory of 2664	2700	Purchase Samples-404995.exe	34
PID 2700 wrote to memory of 2664	2700	Purchase Samples-404995.exe	34
PID 2700 wrote to memory of 2664	2700	Purchase Samples-404995.exe	34
PID 2700 wrote to memory of 2664	2700	Purchase Samples-404995.exe	34

C:\Users\Admin\AppData\Local\Temp\Purchase Samples-404995.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Samples-404995.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\Purchase Samples-404995.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Samples-404995.exe"
  2⤵
  PID:2572
- C:\Users\Admin\AppData\Local\Temp\Purchase Samples-404995.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Samples-404995.exe"
  2⤵
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\Purchase Samples-404995.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Samples-404995.exe"
  2⤵
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\Purchase Samples-404995.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Samples-404995.exe"
  2⤵
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\Purchase Samples-404995.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Samples-404995.exe"
  2⤵
  PID:2664

memory/2700-0-0x0000000074B00000-0x00000000751EE000-memory.dmp

Download

memory/2700-1-0x00000000003F0000-0x000000000048A000-memory.dmp

Download

memory/2700-2-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Download

memory/2700-3-0x0000000000690000-0x00000000006A2000-memory.dmp

Download

memory/2700-4-0x0000000074B00000-0x00000000751EE000-memory.dmp

Download

memory/2700-5-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Download

memory/2700-6-0x00000000006D0000-0x00000000006D8000-memory.dmp

Download

memory/2700-7-0x00000000006F0000-0x00000000006FA000-memory.dmp

Download

memory/2700-8-0x00000000056A0000-0x000000000570E000-memory.dmp

Download

memory/2700-9-0x0000000074B00000-0x00000000751EE000-memory.dmp

Download