7558e973bff2426aca4278e62668478f8afc5fb5afcc5e0f77bbdbd733b84ac8

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 17:41

Target

INVOICE.exe
Size

676KB
MD5

458d13e193d1def40ff8862d04ee3839
SHA1

2441106df18080573cd0691f86c254e4e0a6193e
SHA256

ddc5d1c80b07a16ba4a2d8d289dcfccaa1c2f25a525d96f223be8c8eedf9e9e6
SHA512

c72ace9e6a680f087715a1727cf89e4dc5e490b697d238681662a3f0bb0df0a0184ab92c469b6aaa6fb29ba8871eb69620fa98cb3c27cddfb76b20f8a56df0c1
SSDEEP

12288:57jia5WBDPVjYEeDxwq0BbIH+pKgzRltb2WupXMPj1pFSKgBqKTcmYkV+/1PLfWN:BGB7VjYHDxl8b+MKoRrKpXiJpFSKgBqi

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

INVOICE.exe

pid process

1296 INVOICE.exe
1296 INVOICE.exe
1296 INVOICE.exe
1296 INVOICE.exe
1296 INVOICE.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

INVOICE.exe

description pid process

Token: SeDebugPrivilege 1296 INVOICE.exe

description	pid	process
Token: SeDebugPrivilege	1296	INVOICE.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

INVOICE.exe

description	pid	process	target process
PID 1296 wrote to memory of 2604	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2604	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2604	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2604	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2620	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2620	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2620	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2620	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2624	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2624	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2624	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2624	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2668	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2668	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2668	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2668	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2644	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2644	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2644	1296	INVOICE.exe	INVOICE.exe
PID 1296 wrote to memory of 2644	1296	INVOICE.exe	INVOICE.exe

C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
2⤵
PID:2604

C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
2⤵
PID:2620

C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
2⤵
PID:2624

C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
2⤵
PID:2668

C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
2⤵
PID:2644

memory/1296-0-0x00000000003B0000-0x000000000045E000-memory.dmp

Filesize
696KB

Download
memory/1296-1-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/1296-2-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

Filesize
256KB

Download
memory/1296-3-0x00000000002F0000-0x0000000000302000-memory.dmp

Filesize
72KB

Download
memory/1296-4-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/1296-5-0x00000000075C0000-0x0000000007642000-memory.dmp

Filesize
520KB

Download
memory/1296-6-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download