84f9f7e99da512f5ef8d160810783489ace28e11061119d0f66e1256ba2dd9fa

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 23:37

Target

d4a789e7f16a31af5abe3cc6d0b9062d.exe
Size

408KB
MD5

d4a789e7f16a31af5abe3cc6d0b9062d
SHA1

98e18efe85dc0fa71723bf1c3a004d15d5971715
SHA256

84f9f7e99da512f5ef8d160810783489ace28e11061119d0f66e1256ba2dd9fa
SHA512

bbb2640dd792ca0ed4dbcffbe83bd57a657612c33c24fa408a57ba72c242908438d941167b7f53f26bbf1a9fdd429840127766e79f3057e272c3c04b32faa588
SSDEEP

6144:KvIiHktOtG997Ttsr/2OCNZqzhNSvIiHktOtG997Ttsr/2OCNZqzhNP8K:KvIez0ercNZqzhwvIez0ercNZqzhx

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2452	d4a789e7f16a31af5abe3cc6d0b9062d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2452	d4a789e7f16a31af5abe3cc6d0b9062d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2896	2452	d4a789e7f16a31af5abe3cc6d0b9062d.exe	28
PID 2452 wrote to memory of 2896	2452	d4a789e7f16a31af5abe3cc6d0b9062d.exe	28
PID 2452 wrote to memory of 2896	2452	d4a789e7f16a31af5abe3cc6d0b9062d.exe	28
PID 2452 wrote to memory of 2896	2452	d4a789e7f16a31af5abe3cc6d0b9062d.exe	28

C:\Users\Admin\AppData\Local\Temp\d4a789e7f16a31af5abe3cc6d0b9062d.exe
"C:\Users\Admin\AppData\Local\Temp\d4a789e7f16a31af5abe3cc6d0b9062d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 524
  2⤵
  PID:2896

memory/2452-0-0x0000000074600000-0x0000000074BAB000-memory.dmp

Filesize
5.7MB

Download
memory/2452-1-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

Filesize
256KB

Download
memory/2452-2-0x0000000074600000-0x0000000074BAB000-memory.dmp

Filesize
5.7MB

Download
memory/2452-4-0x0000000074600000-0x0000000074BAB000-memory.dmp

Filesize
5.7MB

Download
memory/2452-5-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

Filesize
256KB

Download
memory/2896-3-0x0000000001E30000-0x0000000001E31000-memory.dmp

Filesize
4KB

Download