2bd9d64f0a291f17f1db4d10df0ac690508912e2720fadf24e7b33d11ffef781

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
06-12-2023 04:07

Target

R7275-12112023.exe
Size

1.1MB
MD5

cbdcf99f5255ed189e1135067b2e64e0
SHA1

fb18f5f1a346db21f062d8b88893bc428fc472e7
SHA256

1d7b401ea7bf4f36433e63335d35807a419d1c1fc2c3f1ef1702898713e11757
SHA512

691c25339317be4e73df957dd859c5904607ae5dae3cbc5a702705fe924944c83e4433b61d77d2c1708c2f253b33276706a992b848620ece0b2bd5d31476d90c
SSDEEP

24576:rclEznOqRtyOuiNRh5XYaNjetr6XgE+qlHb8f9K:UEznOaNRh5XYaNjet2XpFJ8fk

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

R7275-12112023.exe

pid process

2172 R7275-12112023.exe
2172 R7275-12112023.exe
2172 R7275-12112023.exe
2172 R7275-12112023.exe
2172 R7275-12112023.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

R7275-12112023.exe

description pid process

Token: SeDebugPrivilege 2172 R7275-12112023.exe

description	pid	process
Token: SeDebugPrivilege	2172	R7275-12112023.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

R7275-12112023.exe

description	pid	process	target process
PID 2172 wrote to memory of 2420	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2420	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2420	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2420	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2200	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2200	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2200	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2200	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2288	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2288	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2288	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2288	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2676	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2676	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2676	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2676	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2684	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2684	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2684	2172	R7275-12112023.exe	R7275-12112023.exe
PID 2172 wrote to memory of 2684	2172	R7275-12112023.exe	R7275-12112023.exe

C:\Users\Admin\AppData\Local\Temp\R7275-12112023.exe
"C:\Users\Admin\AppData\Local\Temp\R7275-12112023.exe"
2⤵
PID:2420

C:\Users\Admin\AppData\Local\Temp\R7275-12112023.exe
"C:\Users\Admin\AppData\Local\Temp\R7275-12112023.exe"
2⤵
PID:2200

C:\Users\Admin\AppData\Local\Temp\R7275-12112023.exe
"C:\Users\Admin\AppData\Local\Temp\R7275-12112023.exe"
2⤵
PID:2288

C:\Users\Admin\AppData\Local\Temp\R7275-12112023.exe
"C:\Users\Admin\AppData\Local\Temp\R7275-12112023.exe"
2⤵
PID:2676

C:\Users\Admin\AppData\Local\Temp\R7275-12112023.exe
"C:\Users\Admin\AppData\Local\Temp\R7275-12112023.exe"
2⤵
PID:2684

memory/2172-0-0x0000000000320000-0x000000000043A000-memory.dmp

Filesize
1.1MB

Download
memory/2172-1-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2172-2-0x0000000004F00000-0x0000000004F40000-memory.dmp

Filesize
256KB

Download
memory/2172-3-0x00000000002D0000-0x00000000002E6000-memory.dmp

Filesize
88KB

Download
memory/2172-4-0x00000000002F0000-0x00000000002FA000-memory.dmp

Filesize
40KB

Download
memory/2172-5-0x00000000051F0000-0x0000000005294000-memory.dmp

Filesize
656KB

Download
memory/2172-6-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download