e477f1e27f4484425cc8317e0a0abbbf81fcbd4944714abbf702b6d27c811ea6

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19/09/2023, 16:24

Target
0220829_PEDIDO_22073M_PROTECO.exe
Size 714KB
Sample230919-twc3vaae2v
SHA256 e477f1e27f4484425cc8317e0a0abbbf81fcbd4944714abbf702b6d27c811ea6
MD5 605e6589c475b160f8a52b6c416d96dc
SHA1 835402f4e4532d1ac3b817a2f8e004ec81297b19
SHA512 973709b30743b06ce0178ae9281e2a0b8c0740239ff2617aaf08739299632313dde1aac9455897af8faf35839810958bc8738da1156b5197c47f262f407bbd0c
SSDEEP 12288:lr+vUcfJw1UN0x1To6zIAjCVC/w0NVuHydiYGtQCQWmJXq9TUdBzt7fJ:dCBwHxhjzxDu5zQsmcTUrz9B
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	0220829_PEDIDO_22073M_PROTECO.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2724	2956	0220829_PEDIDO_22073M_PROTECO.exe	30
PID 2956 wrote to memory of 2724	2956	0220829_PEDIDO_22073M_PROTECO.exe	30
PID 2956 wrote to memory of 2724	2956	0220829_PEDIDO_22073M_PROTECO.exe	30
PID 2956 wrote to memory of 2724	2956	0220829_PEDIDO_22073M_PROTECO.exe	30
PID 2956 wrote to memory of 2728	2956	0220829_PEDIDO_22073M_PROTECO.exe	31
PID 2956 wrote to memory of 2728	2956	0220829_PEDIDO_22073M_PROTECO.exe	31
PID 2956 wrote to memory of 2728	2956	0220829_PEDIDO_22073M_PROTECO.exe	31
PID 2956 wrote to memory of 2728	2956	0220829_PEDIDO_22073M_PROTECO.exe	31
PID 2956 wrote to memory of 2748	2956	0220829_PEDIDO_22073M_PROTECO.exe	32
PID 2956 wrote to memory of 2748	2956	0220829_PEDIDO_22073M_PROTECO.exe	32
PID 2956 wrote to memory of 2748	2956	0220829_PEDIDO_22073M_PROTECO.exe	32
PID 2956 wrote to memory of 2748	2956	0220829_PEDIDO_22073M_PROTECO.exe	32
PID 2956 wrote to memory of 2768	2956	0220829_PEDIDO_22073M_PROTECO.exe	33
PID 2956 wrote to memory of 2768	2956	0220829_PEDIDO_22073M_PROTECO.exe	33
PID 2956 wrote to memory of 2768	2956	0220829_PEDIDO_22073M_PROTECO.exe	33
PID 2956 wrote to memory of 2768	2956	0220829_PEDIDO_22073M_PROTECO.exe	33
PID 2956 wrote to memory of 2872	2956	0220829_PEDIDO_22073M_PROTECO.exe	34
PID 2956 wrote to memory of 2872	2956	0220829_PEDIDO_22073M_PROTECO.exe	34
PID 2956 wrote to memory of 2872	2956	0220829_PEDIDO_22073M_PROTECO.exe	34
PID 2956 wrote to memory of 2872	2956	0220829_PEDIDO_22073M_PROTECO.exe	34

C:\Users\Admin\AppData\Local\Temp\0220829_PEDIDO_22073M_PROTECO.exe
"C:\Users\Admin\AppData\Local\Temp\0220829_PEDIDO_22073M_PROTECO.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\0220829_PEDIDO_22073M_PROTECO.exe
  "C:\Users\Admin\AppData\Local\Temp\0220829_PEDIDO_22073M_PROTECO.exe"
  2⤵
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\0220829_PEDIDO_22073M_PROTECO.exe
  "C:\Users\Admin\AppData\Local\Temp\0220829_PEDIDO_22073M_PROTECO.exe"
  2⤵
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\0220829_PEDIDO_22073M_PROTECO.exe
  "C:\Users\Admin\AppData\Local\Temp\0220829_PEDIDO_22073M_PROTECO.exe"
  2⤵
  PID:2748
- C:\Users\Admin\AppData\Local\Temp\0220829_PEDIDO_22073M_PROTECO.exe
  "C:\Users\Admin\AppData\Local\Temp\0220829_PEDIDO_22073M_PROTECO.exe"
  2⤵
  PID:2768
- C:\Users\Admin\AppData\Local\Temp\0220829_PEDIDO_22073M_PROTECO.exe
  "C:\Users\Admin\AppData\Local\Temp\0220829_PEDIDO_22073M_PROTECO.exe"
  2⤵
  PID:2872

memory/2956-1-0x0000000074470000-0x0000000074B5E000-memory.dmp

Download

memory/2956-0-0x0000000000370000-0x0000000000428000-memory.dmp

Download

memory/2956-2-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Download

memory/2956-3-0x0000000000310000-0x0000000000328000-memory.dmp

Download

memory/2956-4-0x0000000074470000-0x0000000074B5E000-memory.dmp

Download

memory/2956-5-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Download

memory/2956-6-0x0000000000330000-0x000000000033A000-memory.dmp

Download

memory/2956-7-0x0000000005270000-0x00000000052EC000-memory.dmp

Download

memory/2956-8-0x0000000074470000-0x0000000074B5E000-memory.dmp

Download