7308e5766a782636622a54521762190a9421dd033fd4cd661d127cd2e781137b

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 06:30

Target

2024-05-13_cbdad3a2e768eba41729b7d937dedaef_megazord.exe
Size

17.2MB
MD5

cbdad3a2e768eba41729b7d937dedaef
SHA1

2ceb6c83b3ebd2519b759c753a18f9d35ac0f226
SHA256

7308e5766a782636622a54521762190a9421dd033fd4cd661d127cd2e781137b
SHA512

c55f4f9d0c6cacfe4d5f430c2084907f8d5ba00ba0581dd9a812ae5292fe59cbb6a0371869391cbf0e61c42a2e035161bad70a5b60d862d9b9d601f575c3de7a
SSDEEP

196608:6hCe9IfzJidXDDG9Fz8yy6JdRV5K7Z0FwibCN:6QeufzJiVW9FwCJdRVbFwBN

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2840	2024-05-13_cbdad3a2e768eba41729b7d937dedaef_megazord.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	2024-05-13_cbdad3a2e768eba41729b7d937dedaef_megazord.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2464	2840	2024-05-13_cbdad3a2e768eba41729b7d937dedaef_megazord.exe	29
PID 2840 wrote to memory of 2464	2840	2024-05-13_cbdad3a2e768eba41729b7d937dedaef_megazord.exe	29
PID 2840 wrote to memory of 2464	2840	2024-05-13_cbdad3a2e768eba41729b7d937dedaef_megazord.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-05-13_cbdad3a2e768eba41729b7d937dedaef_megazord.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-13_cbdad3a2e768eba41729b7d937dedaef_megazord.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2840 -s 528
  2⤵
  PID:2464

memory/2840-1-0x00000000028F0000-0x0000000002B20000-memory.dmp

Filesize
2.2MB

Download
memory/2840-51-0x0000000002490000-0x00000000024A0000-memory.dmp

Filesize
64KB

Download
memory/2840-47-0x0000000002450000-0x0000000002470000-memory.dmp

Filesize
128KB

Download
memory/2840-43-0x0000000001F20000-0x0000000001F30000-memory.dmp

Filesize
64KB

Download
memory/2840-39-0x0000000001D70000-0x0000000001D80000-memory.dmp

Filesize
64KB

Download
memory/2840-35-0x0000000001CD0000-0x0000000001CE0000-memory.dmp

Filesize
64KB

Download
memory/2840-31-0x0000000001CA0000-0x0000000001CB0000-memory.dmp

Filesize
64KB

Download
memory/2840-27-0x0000000001C80000-0x0000000001C90000-memory.dmp

Filesize
64KB

Download
memory/2840-23-0x0000000001C60000-0x0000000001C70000-memory.dmp

Filesize
64KB

Download
memory/2840-19-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/2840-15-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2840-11-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/2840-6-0x0000000002EE0000-0x00000000032A0000-memory.dmp

Filesize
3.8MB

Download
memory/2840-5-0x000000013F7A7000-0x000000013F7A9000-memory.dmp

Filesize
8KB

Download