eddd269a3a529125e45b9c50f29bc7ac664d0f61e85e4035137f38d6e59abc84

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231201-en
resource tags

arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system
submitted
07-12-2023 01:43

Target

PO12308.exe
Size

694KB
MD5

1d3a8a121376bf64ec58a7b019241697
SHA1

33ac1efd81943a55537f03851bcdb1e1ef583775
SHA256

56ec132d9642242d2426063fb8763cb8d74973bbc186fd6d55eeebf3936a60f7
SHA512

85526fd1f61620626d59a54953ee15e95d6c5420dc608913e874557e333d819aadade94d7e49ebf2839ee11d3009074adea805e7052af625a1c3d1c7fb614eeb
SSDEEP

12288:gueH5qKXIk3zC/XcNiG5FgTf1qrTP3KL32dlQgU5GUtGcWld7Sxc:EqeKcwGb+dqrTfHdlQgUGvgc

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	PO12308.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2828	2944	PO12308.exe	28
PID 2944 wrote to memory of 2828	2944	PO12308.exe	28
PID 2944 wrote to memory of 2828	2944	PO12308.exe	28
PID 2944 wrote to memory of 2828	2944	PO12308.exe	28
PID 2944 wrote to memory of 2844	2944	PO12308.exe	29
PID 2944 wrote to memory of 2844	2944	PO12308.exe	29
PID 2944 wrote to memory of 2844	2944	PO12308.exe	29
PID 2944 wrote to memory of 2844	2944	PO12308.exe	29
PID 2944 wrote to memory of 2792	2944	PO12308.exe	30
PID 2944 wrote to memory of 2792	2944	PO12308.exe	30
PID 2944 wrote to memory of 2792	2944	PO12308.exe	30
PID 2944 wrote to memory of 2792	2944	PO12308.exe	30
PID 2944 wrote to memory of 2716	2944	PO12308.exe	31
PID 2944 wrote to memory of 2716	2944	PO12308.exe	31
PID 2944 wrote to memory of 2716	2944	PO12308.exe	31
PID 2944 wrote to memory of 2716	2944	PO12308.exe	31
PID 2944 wrote to memory of 2684	2944	PO12308.exe	32
PID 2944 wrote to memory of 2684	2944	PO12308.exe	32
PID 2944 wrote to memory of 2684	2944	PO12308.exe	32
PID 2944 wrote to memory of 2684	2944	PO12308.exe	32

C:\Users\Admin\AppData\Local\Temp\PO12308.exe
"C:\Users\Admin\AppData\Local\Temp\PO12308.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\PO12308.exe
  "C:\Users\Admin\AppData\Local\Temp\PO12308.exe"
  2⤵
  PID:2828
- C:\Users\Admin\AppData\Local\Temp\PO12308.exe
  "C:\Users\Admin\AppData\Local\Temp\PO12308.exe"
  2⤵
  PID:2844
- C:\Users\Admin\AppData\Local\Temp\PO12308.exe
  "C:\Users\Admin\AppData\Local\Temp\PO12308.exe"
  2⤵
  PID:2792
- C:\Users\Admin\AppData\Local\Temp\PO12308.exe
  "C:\Users\Admin\AppData\Local\Temp\PO12308.exe"
  2⤵
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\PO12308.exe
  "C:\Users\Admin\AppData\Local\Temp\PO12308.exe"
  2⤵
  PID:2684

memory/2944-0-0x0000000000370000-0x0000000000424000-memory.dmp

Filesize
720KB

Download
memory/2944-1-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2944-2-0x0000000004D40000-0x0000000004D80000-memory.dmp

Filesize
256KB

Download
memory/2944-3-0x00000000002E0000-0x00000000002FA000-memory.dmp

Filesize
104KB

Download
memory/2944-4-0x0000000000300000-0x0000000000308000-memory.dmp

Filesize
32KB

Download
memory/2944-5-0x0000000000310000-0x000000000031A000-memory.dmp

Filesize
40KB

Download
memory/2944-6-0x0000000005120000-0x000000000519A000-memory.dmp

Filesize
488KB

Download
memory/2944-7-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download