6447cac73ac33854ef0f940ef37b0ab07f9b6852d6e93b16cfc821e6a2c8756c

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 03:45

Target

0d608561f2cd7fbe41b08f9a5a01228f.exe
Size

2.7MB
MD5

0d608561f2cd7fbe41b08f9a5a01228f
SHA1

0b1ce4bde66214d64ebf50d9c7491ee933ffee64
SHA256

6447cac73ac33854ef0f940ef37b0ab07f9b6852d6e93b16cfc821e6a2c8756c
SHA512

d47fc5852fcb50c2c354d5871386ef226e3e6ce3fa3d5b0bca029fd229656daf24ca84953c2f15c98f67b9b211d3d51ef0712a738492c9e51d9d27d8a993870f
SSDEEP

49152:axO686ZUfB9XkR9RBXk5JioQrgzgvuwQFop0XF0UEoIyjT2/:axO686ifC9c5EszgvuwQFop9ToIyj6

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	0d608561f2cd7fbe41b08f9a5a01228f.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2608	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	30
PID 840 wrote to memory of 2608	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	30
PID 840 wrote to memory of 2608	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	30
PID 840 wrote to memory of 2608	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	30
PID 840 wrote to memory of 2620	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	32
PID 840 wrote to memory of 2620	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	32
PID 840 wrote to memory of 2620	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	32
PID 840 wrote to memory of 2620	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	32
PID 840 wrote to memory of 2640	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	31
PID 840 wrote to memory of 2640	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	31
PID 840 wrote to memory of 2640	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	31
PID 840 wrote to memory of 2640	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	31
PID 840 wrote to memory of 2728	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	33
PID 840 wrote to memory of 2728	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	33
PID 840 wrote to memory of 2728	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	33
PID 840 wrote to memory of 2728	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	33
PID 840 wrote to memory of 1708	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	34
PID 840 wrote to memory of 1708	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	34
PID 840 wrote to memory of 1708	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	34
PID 840 wrote to memory of 1708	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	34

C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe
"C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe
  "C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe"
  2⤵
  PID:2608
- C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe
  "C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe"
  2⤵
  PID:2640
- C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe
  "C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe"
  2⤵
  PID:2620
- C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe
  "C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe"
  2⤵
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe
  "C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe"
  2⤵
  PID:1708

memory/840-0-0x0000000000070000-0x000000000032E000-memory.dmp

Filesize
2.7MB

Download
memory/840-1-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/840-2-0x0000000004F30000-0x0000000004F70000-memory.dmp

Filesize
256KB

Download
memory/840-3-0x00000000006E0000-0x00000000006FE000-memory.dmp

Filesize
120KB

Download
memory/840-4-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/840-5-0x0000000004F30000-0x0000000004F70000-memory.dmp

Filesize
256KB

Download
memory/840-6-0x0000000005E00000-0x0000000005FF0000-memory.dmp

Filesize
1.9MB

Download
memory/840-7-0x00000000092A0000-0x0000000009418000-memory.dmp

Filesize
1.5MB

Download
memory/840-8-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download