f21e47776beb54fbd0d81142efca18fe1d2216a11eb5490ebe8aeb8c433aada6

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-12-2023 07:58

Target

B.exe
Size

716KB
MD5

8c366167246b6e371d4be611105206e3
SHA1

5689b19440aaa57b8893f7fabaff725963b92483
SHA256

bee896925d62192aff4e13abda9cc0cff1cd063778b2dadb45035edd5d274c8a
SHA512

9b5089b2656c24ac82b3c01e1d22e6bea3a1e1906104e5080a07404162b4cf595624ccd989c49341852fc22a939a3d84064fe54deb95b37ebc5b944146ebde7a
SSDEEP

12288:rFdIfzChVnn1eJmllQAxyvyHhCR55JyRM/zZ0QEVJK:JszChV9wYtHhCR5/zqQeI

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

B.exe

pid process

2664 B.exe
2664 B.exe
2664 B.exe
2664 B.exe
2664 B.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

B.exe

description pid process

Token: SeDebugPrivilege 2664 B.exe

description	pid	process
Token: SeDebugPrivilege	2664	B.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

B.exe

description	pid	process	target process
PID 2664 wrote to memory of 3060	2664	B.exe	B.exe
PID 2664 wrote to memory of 3060	2664	B.exe	B.exe
PID 2664 wrote to memory of 3060	2664	B.exe	B.exe
PID 2664 wrote to memory of 3060	2664	B.exe	B.exe
PID 2664 wrote to memory of 2772	2664	B.exe	B.exe
PID 2664 wrote to memory of 2772	2664	B.exe	B.exe
PID 2664 wrote to memory of 2772	2664	B.exe	B.exe
PID 2664 wrote to memory of 2772	2664	B.exe	B.exe
PID 2664 wrote to memory of 2120	2664	B.exe	B.exe
PID 2664 wrote to memory of 2120	2664	B.exe	B.exe
PID 2664 wrote to memory of 2120	2664	B.exe	B.exe
PID 2664 wrote to memory of 2120	2664	B.exe	B.exe
PID 2664 wrote to memory of 2676	2664	B.exe	B.exe
PID 2664 wrote to memory of 2676	2664	B.exe	B.exe
PID 2664 wrote to memory of 2676	2664	B.exe	B.exe
PID 2664 wrote to memory of 2676	2664	B.exe	B.exe
PID 2664 wrote to memory of 1576	2664	B.exe	B.exe
PID 2664 wrote to memory of 1576	2664	B.exe	B.exe
PID 2664 wrote to memory of 1576	2664	B.exe	B.exe
PID 2664 wrote to memory of 1576	2664	B.exe	B.exe

C:\Users\Admin\AppData\Local\Temp\B.exe
"C:\Users\Admin\AppData\Local\Temp\B.exe"
2⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\B.exe
"C:\Users\Admin\AppData\Local\Temp\B.exe"
2⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\B.exe
"C:\Users\Admin\AppData\Local\Temp\B.exe"
2⤵
PID:2120

C:\Users\Admin\AppData\Local\Temp\B.exe
"C:\Users\Admin\AppData\Local\Temp\B.exe"
2⤵
PID:2676

C:\Users\Admin\AppData\Local\Temp\B.exe
"C:\Users\Admin\AppData\Local\Temp\B.exe"
2⤵
PID:1576

memory/2664-0-0x0000000000370000-0x000000000042A000-memory.dmp

Filesize
744KB

Download
memory/2664-1-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/2664-2-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/2664-3-0x0000000000610000-0x0000000000626000-memory.dmp

Filesize
88KB

Download
memory/2664-4-0x0000000001D70000-0x0000000001D78000-memory.dmp

Filesize
32KB

Download
memory/2664-5-0x0000000001D80000-0x0000000001D8A000-memory.dmp

Filesize
40KB

Download
memory/2664-6-0x0000000005BD0000-0x0000000005C4A000-memory.dmp

Filesize
488KB

Download
memory/2664-7-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download