15a05098b91575cb0da6964367040dc8a0051a4fa8a0db4d26fdb8aaa570ceae

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
24/11/2023, 11:16

Target

tmp.exe
Size

3.7MB
MD5

25b7db2e9639ba61450f5cddf04fa4b5
SHA1

f044a30b2b2f46b19dc373e56e391caa9d9fe5b5
SHA256

15a05098b91575cb0da6964367040dc8a0051a4fa8a0db4d26fdb8aaa570ceae
SHA512

2bfddedd852c4edb302b993abdeb8fda0613e23a7bcc12ecd58d93ec64bdff3a54a8634864df65d8b826710f149ba72df39719160ef2d03d5d23a16bc2aa6aef
SSDEEP

98304:3w9lSvzZOK2rOqoD4OUhUelI2ckBvkBk:3llORrODLUZqwvk6

Score

1^/10

Suspicious behavior: EnumeratesProcesses 20 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	tmp.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2224	2200	tmp.exe	28
PID 2200 wrote to memory of 2224	2200	tmp.exe	28
PID 2200 wrote to memory of 2224	2200	tmp.exe	28
PID 2200 wrote to memory of 2836	2200	tmp.exe	29
PID 2200 wrote to memory of 2836	2200	tmp.exe	29
PID 2200 wrote to memory of 2836	2200	tmp.exe	29
PID 2200 wrote to memory of 2920	2200	tmp.exe	30
PID 2200 wrote to memory of 2920	2200	tmp.exe	30
PID 2200 wrote to memory of 2920	2200	tmp.exe	30
PID 2200 wrote to memory of 2840	2200	tmp.exe	31
PID 2200 wrote to memory of 2840	2200	tmp.exe	31
PID 2200 wrote to memory of 2840	2200	tmp.exe	31
PID 2200 wrote to memory of 2320	2200	tmp.exe	32
PID 2200 wrote to memory of 2320	2200	tmp.exe	32
PID 2200 wrote to memory of 2320	2200	tmp.exe	32
PID 2200 wrote to memory of 2244	2200	tmp.exe	33
PID 2200 wrote to memory of 2244	2200	tmp.exe	33
PID 2200 wrote to memory of 2244	2200	tmp.exe	33
PID 2200 wrote to memory of 2060	2200	tmp.exe	34
PID 2200 wrote to memory of 2060	2200	tmp.exe	34
PID 2200 wrote to memory of 2060	2200	tmp.exe	34
PID 2200 wrote to memory of 2364	2200	tmp.exe	35
PID 2200 wrote to memory of 2364	2200	tmp.exe	35
PID 2200 wrote to memory of 2364	2200	tmp.exe	35
PID 2200 wrote to memory of 2072	2200	tmp.exe	36
PID 2200 wrote to memory of 2072	2200	tmp.exe	36
PID 2200 wrote to memory of 2072	2200	tmp.exe	36
PID 2200 wrote to memory of 2700	2200	tmp.exe	37
PID 2200 wrote to memory of 2700	2200	tmp.exe	37
PID 2200 wrote to memory of 2700	2200	tmp.exe	37

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  PID:2224
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  PID:2836
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  PID:2920
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  PID:2840
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  PID:2320
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  PID:2244
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  PID:2364
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  PID:2072
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  PID:2700

memory/2200-0-0x0000000000940000-0x0000000000CF4000-memory.dmp

Filesize
3.7MB

Download
memory/2200-1-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

Filesize
9.9MB

Download
memory/2200-2-0x000000001B270000-0x000000001B524000-memory.dmp

Filesize
2.7MB

Download
memory/2200-3-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/2200-4-0x000000001BA40000-0x000000001BCDA000-memory.dmp

Filesize
2.6MB

Download
memory/2200-5-0x000000001BCE0000-0x000000001BF7A000-memory.dmp

Filesize
2.6MB

Download
memory/2200-6-0x00000000004E0000-0x000000000052C000-memory.dmp

Filesize
304KB

Download
memory/2200-7-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

Filesize
9.9MB

Download