7ea4a70d11f9b347dc1130489ca32322875d587f11963d3b8c6e8583eac113b7

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
28-11-2023 06:48

Target

contract.exe
Size

522KB
MD5

721e61ae010bd0e683bda80e28b977ae
SHA1

f2d3cbe4c62f632eff574c3816a231d40ab0fdfa
SHA256

7ea4a70d11f9b347dc1130489ca32322875d587f11963d3b8c6e8583eac113b7
SHA512

9a853f4c31a1700c59214ec784d4514f7d5204aec12bbd02f7f3517dd8dd0e5cb94a37e5b96a7c70535aba31d1835b52c32737a7f8ea3f169bbec76c0d955fb2
SSDEEP

12288:Ap0CQmbCp8HBSR67V2xEbJ8Wp/sUCw6n8Ki70vspK:BsPaUCw68PQu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

contract.exe

pid process

2872 contract.exe
2872 contract.exe
2872 contract.exe
2872 contract.exe
2872 contract.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

contract.exe

description pid process

Token: SeDebugPrivilege 2872 contract.exe

description	pid	process
Token: SeDebugPrivilege	2872	contract.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

contract.exe

description	pid	process	target process
PID 2872 wrote to memory of 2808	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2808	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2808	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2808	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2812	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2812	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2812	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2812	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2828	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2828	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2828	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2828	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2860	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2860	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2860	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2860	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2804	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2804	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2804	2872	contract.exe	contract.exe
PID 2872 wrote to memory of 2804	2872	contract.exe	contract.exe

C:\Users\Admin\AppData\Local\Temp\contract.exe
"C:\Users\Admin\AppData\Local\Temp\contract.exe"
2⤵
PID:2808

C:\Users\Admin\AppData\Local\Temp\contract.exe
"C:\Users\Admin\AppData\Local\Temp\contract.exe"
2⤵
PID:2812

C:\Users\Admin\AppData\Local\Temp\contract.exe
"C:\Users\Admin\AppData\Local\Temp\contract.exe"
2⤵
PID:2828

C:\Users\Admin\AppData\Local\Temp\contract.exe
"C:\Users\Admin\AppData\Local\Temp\contract.exe"
2⤵
PID:2860

C:\Users\Admin\AppData\Local\Temp\contract.exe
"C:\Users\Admin\AppData\Local\Temp\contract.exe"
2⤵
PID:2804

memory/2872-0-0x0000000000390000-0x0000000000418000-memory.dmp

Filesize
544KB

Download
memory/2872-1-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Filesize
6.9MB

Download
memory/2872-2-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/2872-3-0x0000000000310000-0x000000000032A000-memory.dmp

Filesize
104KB

Download
memory/2872-4-0x00000000002B0000-0x00000000002B8000-memory.dmp

Filesize
32KB

Download
memory/2872-5-0x0000000000330000-0x000000000033A000-memory.dmp

Filesize
40KB

Download
memory/2872-6-0x00000000050E0000-0x000000000513E000-memory.dmp

Filesize
376KB

Download
memory/2872-7-0x0000000073CE0000-0x00000000743CE000-memory.dmp

Filesize
6.9MB

Download