743c0c8feb27f9817c78778b6c98d0a895f15e1db8e5c9beebe4195676d86b7b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:41

Target

2289aa5f72ebcb3a517b4069174618b1.exe
Size

864KB
MD5

2289aa5f72ebcb3a517b4069174618b1
SHA1

47d910f92b26a0d9b9c5b77a93098569261fb985
SHA256

743c0c8feb27f9817c78778b6c98d0a895f15e1db8e5c9beebe4195676d86b7b
SHA512

45d8b411b2ee8c46ae2833808c2f2cfef8e44bb87f282a8b76f943fe063d1e4a6d769e580a9b81ae0b4b791b2c3433545fd4d2535d99ddc123a31deaded9cfe8
SSDEEP

12288:prXpX3TZJD4uZ8fWrmCBHH3prXpX3TZJD4uZ8fWrmCBgBcZViDY/:9XtDZJDYfWrmCBtXtDZJDYfWrmCBYfg

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2372	2289aa5f72ebcb3a517b4069174618b1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	2289aa5f72ebcb3a517b4069174618b1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2916	2372	2289aa5f72ebcb3a517b4069174618b1.exe	17
PID 2372 wrote to memory of 2916	2372	2289aa5f72ebcb3a517b4069174618b1.exe	17
PID 2372 wrote to memory of 2916	2372	2289aa5f72ebcb3a517b4069174618b1.exe	17
PID 2372 wrote to memory of 2972	2372	2289aa5f72ebcb3a517b4069174618b1.exe	18
PID 2372 wrote to memory of 2972	2372	2289aa5f72ebcb3a517b4069174618b1.exe	18
PID 2372 wrote to memory of 2972	2372	2289aa5f72ebcb3a517b4069174618b1.exe	18

C:\Users\Admin\AppData\Local\Temp\2289aa5f72ebcb3a517b4069174618b1.exe
"C:\Users\Admin\AppData\Local\Temp\2289aa5f72ebcb3a517b4069174618b1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\2289aa5f72ebcb3a517b4069174618b1.exe
  C:\Users\Admin\AppData\Local\Temp\2289aa5f72ebcb3a517b4069174618b1.exe
  2⤵
  PID:2916
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 552
  2⤵
  PID:2972

memory/2372-1-0x0000000000BD0000-0x0000000000C50000-memory.dmp

Filesize
512KB

Download
memory/2372-0-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2372-2-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2372-3-0x0000000000BD0000-0x0000000000C50000-memory.dmp

Filesize
512KB

Download
memory/2372-5-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2972-4-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download