394fd2e19aba8f7f2d158e2264b34b909bc1be866c1daabb0490e73e1a17e054

Analysis

max time kernel
141s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 07:28

Target

1111.exe
Size

5.7MB
MD5

5423e26d4cf2246875dc32e478d1838b
SHA1

6e1cd41fdb97e1a8decb224454825fa111b65cf7
SHA256

394fd2e19aba8f7f2d158e2264b34b909bc1be866c1daabb0490e73e1a17e054
SHA512

76f935e9e6121776131359cb3d9c453c80429aafe92433b311d95f6e65202e9371f90bb826919bc5533d7eeda2e76e013d6aa81bb5f27478e3ad7e54a1c39ef7
SSDEEP

98304:Kv2uFB7N82uAeO97DueVBka5+cwdXciRNd0Tsn/VJo+n6Ffh6M60unyojVIPmR2q:CaAeOdDRXka5+LTjnHl6FfhfhuyoOuMq

Score

7^/10

upx

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2500-0-0x0000000000920000-0x0000000001946000-memory.dmp	upx
behavioral1/memory/2500-1-0x0000000000920000-0x0000000001946000-memory.dmp	upx
behavioral1/memory/2500-5-0x0000000000920000-0x0000000001946000-memory.dmp	upx
behavioral1/memory/2500-6-0x0000000000920000-0x0000000001946000-memory.dmp	upx
behavioral1/memory/2500-7-0x0000000000920000-0x0000000001946000-memory.dmp	upx
behavioral1/memory/2500-8-0x0000000000920000-0x0000000001946000-memory.dmp	upx
behavioral1/memory/2500-9-0x0000000000920000-0x0000000001946000-memory.dmp	upx
behavioral1/memory/2500-10-0x0000000000920000-0x0000000001946000-memory.dmp	upx
behavioral1/memory/2500-11-0x0000000000920000-0x0000000001946000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2500	1111.exe
2500	1111.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	whoami.exe
Token: SeDebugPrivilege	2888	whoami.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2996	2500	1111.exe	30
PID 2500 wrote to memory of 2996	2500	1111.exe	30
PID 2500 wrote to memory of 2996	2500	1111.exe	30
PID 2500 wrote to memory of 2888	2500	1111.exe	34
PID 2500 wrote to memory of 2888	2500	1111.exe	34
PID 2500 wrote to memory of 2888	2500	1111.exe	34

C:\Users\Admin\AppData\Local\Temp\1111.exe
"C:\Users\Admin\AppData\Local\Temp\1111.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\whoami.exe
  whoami
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\system32\whoami.exe
  whoami
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2888

memory/2500-0-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-1-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-5-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-6-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-7-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-8-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-9-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-10-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-11-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-12-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-13-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-14-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-15-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download
memory/2500-16-0x0000000000920000-0x0000000001946000-memory.dmp

Filesize
16.1MB

Download