6946d0d3322995d1c4a8f407b8a627e37644dcc4ddef07b97167f9a4e57b0ee1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 11:42

Target

Products Order.exe
Size

757KB
MD5

ab09f11ddb556069549717cc1f37fdc1
SHA1

e4cba5e88d12df5f9b0eb1dab978b48d63f6b57b
SHA256

6946d0d3322995d1c4a8f407b8a627e37644dcc4ddef07b97167f9a4e57b0ee1
SHA512

c85c518d4216cb9316f96d70240093f4193e5817d761623371f9d6cb011c6d2cb2b8c78162bde04e46baa3add624bdb87c9a506eff97326a34b6a271192f34ba
SSDEEP

3072:dYbDPtd2epEFbMkbNZG46Xz3kFE0bFd+m0de2fcRMBLEFx11Hiv2MN+lEEUMIbhp:2BjkbNNhNHG+96+ixbcdWtoBr

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Products Order.exe

pid process

2724 Products Order.exe
2724 Products Order.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Products Order.exe

description pid process

Token: SeDebugPrivilege 2724 Products Order.exe

pid	process
2724	Products Order.exe
2724	Products Order.exe

description	pid	process
Token: SeDebugPrivilege	2724	Products Order.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Products Order.exe

description	pid	process	target process
PID 2724 wrote to memory of 4068	2724	Products Order.exe	aspnet_compiler.exe
PID 2724 wrote to memory of 4068	2724	Products Order.exe	aspnet_compiler.exe
PID 2724 wrote to memory of 4068	2724	Products Order.exe	aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:4068

memory/2724-0-0x00007FF8E5BB3000-0x00007FF8E5BB5000-memory.dmp

Filesize
8KB

Download
memory/2724-1-0x0000000000120000-0x00000000001E2000-memory.dmp

Filesize
776KB

Download
memory/2724-2-0x0000000000A90000-0x0000000000AA4000-memory.dmp

Filesize
80KB

Download