80c217259feafed3d4c5d458cffe7f1c8dc8b00823e47538e73b6ff50bbe0585

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 12:50

Target

Grain push barges Specification.exe
Size

748KB
MD5

1b4f99e90dec458cf13b1da23919a007
SHA1

affe17a51098ff5c18510ed5ecc1df73732e6db4
SHA256

80c217259feafed3d4c5d458cffe7f1c8dc8b00823e47538e73b6ff50bbe0585
SHA512

05efe6facc26eda504628f9642136bf8d67b2ddd8cbbec6903de2228d4fd12c480bb5da7718e74b08ae7c0d0d7a17fb3ae86b68e26f0cfe357a495e77c574099
SSDEEP

12288:Q06gKSa2iNP1UFvp5z7Cf2DYTFUv2RujTcQo4kzBoDiMtuPckRF/IuYhjkv91aHW:/Tk1Fep56TCv3X0SDR3kb/olkF1aT

Score

1^/10

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2028	Grain push barges Specification.exe
2028	Grain push barges Specification.exe
2028	Grain push barges Specification.exe
2028	Grain push barges Specification.exe
2028	Grain push barges Specification.exe
2028	Grain push barges Specification.exe
2028	Grain push barges Specification.exe
2028	Grain push barges Specification.exe
2028	Grain push barges Specification.exe
2028	Grain push barges Specification.exe
2028	Grain push barges Specification.exe
2028	Grain push barges Specification.exe
2028	Grain push barges Specification.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	Grain push barges Specification.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1104	2028	Grain push barges Specification.exe	30
PID 2028 wrote to memory of 1104	2028	Grain push barges Specification.exe	30
PID 2028 wrote to memory of 1104	2028	Grain push barges Specification.exe	30
PID 2028 wrote to memory of 1104	2028	Grain push barges Specification.exe	30
PID 2028 wrote to memory of 2900	2028	Grain push barges Specification.exe	31
PID 2028 wrote to memory of 2900	2028	Grain push barges Specification.exe	31
PID 2028 wrote to memory of 2900	2028	Grain push barges Specification.exe	31
PID 2028 wrote to memory of 2900	2028	Grain push barges Specification.exe	31
PID 2028 wrote to memory of 2640	2028	Grain push barges Specification.exe	32
PID 2028 wrote to memory of 2640	2028	Grain push barges Specification.exe	32
PID 2028 wrote to memory of 2640	2028	Grain push barges Specification.exe	32
PID 2028 wrote to memory of 2640	2028	Grain push barges Specification.exe	32
PID 2028 wrote to memory of 2772	2028	Grain push barges Specification.exe	33
PID 2028 wrote to memory of 2772	2028	Grain push barges Specification.exe	33
PID 2028 wrote to memory of 2772	2028	Grain push barges Specification.exe	33
PID 2028 wrote to memory of 2772	2028	Grain push barges Specification.exe	33
PID 2028 wrote to memory of 2560	2028	Grain push barges Specification.exe	34
PID 2028 wrote to memory of 2560	2028	Grain push barges Specification.exe	34
PID 2028 wrote to memory of 2560	2028	Grain push barges Specification.exe	34
PID 2028 wrote to memory of 2560	2028	Grain push barges Specification.exe	34

C:\Users\Admin\AppData\Local\Temp\Grain push barges Specification.exe
"C:\Users\Admin\AppData\Local\Temp\Grain push barges Specification.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\Grain push barges Specification.exe
  "C:\Users\Admin\AppData\Local\Temp\Grain push barges Specification.exe"
  2⤵
  PID:1104
- C:\Users\Admin\AppData\Local\Temp\Grain push barges Specification.exe
  "C:\Users\Admin\AppData\Local\Temp\Grain push barges Specification.exe"
  2⤵
  PID:2900
- C:\Users\Admin\AppData\Local\Temp\Grain push barges Specification.exe
  "C:\Users\Admin\AppData\Local\Temp\Grain push barges Specification.exe"
  2⤵
  PID:2640
- C:\Users\Admin\AppData\Local\Temp\Grain push barges Specification.exe
  "C:\Users\Admin\AppData\Local\Temp\Grain push barges Specification.exe"
  2⤵
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\Grain push barges Specification.exe
  "C:\Users\Admin\AppData\Local\Temp\Grain push barges Specification.exe"
  2⤵
  PID:2560

memory/2028-0-0x0000000000370000-0x0000000000432000-memory.dmp

Filesize
776KB

Download
memory/2028-1-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download
memory/2028-2-0x0000000004F50000-0x0000000004F90000-memory.dmp

Filesize
256KB

Download
memory/2028-3-0x0000000000300000-0x0000000000318000-memory.dmp

Filesize
96KB

Download
memory/2028-4-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download
memory/2028-5-0x0000000004F50000-0x0000000004F90000-memory.dmp

Filesize
256KB

Download
memory/2028-6-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/2028-7-0x000000000A4A0000-0x000000000A51C000-memory.dmp

Filesize
496KB

Download
memory/2028-8-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download