cfe44cc7a02528dd5cb871658c28524245d3ead8dd3cbedc78815f0e02acb69d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 12:11

Target

gunzipped.exe
Size

587KB
MD5

c5d4468a5ba8ba0e1fac05a48724a32e
SHA1

1f972264fa9206cfa19db93cd0070f349d2138b3
SHA256

cfe44cc7a02528dd5cb871658c28524245d3ead8dd3cbedc78815f0e02acb69d
SHA512

0768111578ef8e385618be45a2f6d66d322f2544248f19b20f0c6081fbaf38df0bdc67e67b5ef4655eb5b021a27b9474fe772da5aaba8ac1d5384ea0b18310d5
SSDEEP

12288:nEhR+Y72LKxA8UH25KC0JTzDsm514p47q8xrW7AkR:nEhn72LV8eP1Qeyp47A

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	gunzipped.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2656	2372	gunzipped.exe	28
PID 2372 wrote to memory of 2656	2372	gunzipped.exe	28
PID 2372 wrote to memory of 2656	2372	gunzipped.exe	28
PID 2372 wrote to memory of 2656	2372	gunzipped.exe	28
PID 2372 wrote to memory of 2684	2372	gunzipped.exe	29
PID 2372 wrote to memory of 2684	2372	gunzipped.exe	29
PID 2372 wrote to memory of 2684	2372	gunzipped.exe	29
PID 2372 wrote to memory of 2684	2372	gunzipped.exe	29
PID 2372 wrote to memory of 2688	2372	gunzipped.exe	30
PID 2372 wrote to memory of 2688	2372	gunzipped.exe	30
PID 2372 wrote to memory of 2688	2372	gunzipped.exe	30
PID 2372 wrote to memory of 2688	2372	gunzipped.exe	30
PID 2372 wrote to memory of 2720	2372	gunzipped.exe	31
PID 2372 wrote to memory of 2720	2372	gunzipped.exe	31
PID 2372 wrote to memory of 2720	2372	gunzipped.exe	31
PID 2372 wrote to memory of 2720	2372	gunzipped.exe	31
PID 2372 wrote to memory of 2736	2372	gunzipped.exe	32
PID 2372 wrote to memory of 2736	2372	gunzipped.exe	32
PID 2372 wrote to memory of 2736	2372	gunzipped.exe	32
PID 2372 wrote to memory of 2736	2372	gunzipped.exe	32

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
  2⤵
  PID:2656
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
  2⤵
  PID:2684
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
  2⤵
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
  2⤵
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
  2⤵
  PID:2736

memory/2372-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

Filesize
4KB

Download
memory/2372-1-0x00000000003D0000-0x0000000000466000-memory.dmp

Filesize
600KB

Download
memory/2372-2-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-3-0x0000000004700000-0x0000000004794000-memory.dmp

Filesize
592KB

Download
memory/2372-4-0x0000000000690000-0x00000000006B2000-memory.dmp

Filesize
136KB

Download
memory/2372-5-0x00000000006F0000-0x00000000006FC000-memory.dmp

Filesize
48KB

Download
memory/2372-6-0x0000000000470000-0x0000000000480000-memory.dmp

Filesize
64KB

Download
memory/2372-7-0x0000000005AB0000-0x0000000005B12000-memory.dmp

Filesize
392KB

Download
memory/2372-8-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download