a9faa8d35189935d7d185f68fe04d637a0a8c58e7f6875af096cf86da3306e5d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 01:28

Target

Purchase Inquiry_#466789.exe
Size

522KB
MD5

5eece0f9333721c96803f39becae9fa3
SHA1

4508905c92a34c55d3b9b9fa5700c6b640b9a200
SHA256

706a564a593479d9948fe8cfe542c4a788a80e3d08c38dc888179c5340023a08
SHA512

09922db0f9814db2398c2f468a56168e36d2b272aafd401dfc607ab78d3599552843cafab443bc6d64997d64fe51774b50adfe952a1938e70390df2d71602144
SSDEEP

12288:EOoSQi8LkpEauXFg5bb4P2mvtjB7NAtAHyDBWjUNoxsdlh62b7e7kR:7LvjE9XFxP2mVN7quHydWjUeWLOe

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	Purchase Inquiry_#466789.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3056	2236	Purchase Inquiry_#466789.exe	28
PID 2236 wrote to memory of 3056	2236	Purchase Inquiry_#466789.exe	28
PID 2236 wrote to memory of 3056	2236	Purchase Inquiry_#466789.exe	28
PID 2236 wrote to memory of 3056	2236	Purchase Inquiry_#466789.exe	28
PID 2236 wrote to memory of 2600	2236	Purchase Inquiry_#466789.exe	29
PID 2236 wrote to memory of 2600	2236	Purchase Inquiry_#466789.exe	29
PID 2236 wrote to memory of 2600	2236	Purchase Inquiry_#466789.exe	29
PID 2236 wrote to memory of 2600	2236	Purchase Inquiry_#466789.exe	29
PID 2236 wrote to memory of 2564	2236	Purchase Inquiry_#466789.exe	30
PID 2236 wrote to memory of 2564	2236	Purchase Inquiry_#466789.exe	30
PID 2236 wrote to memory of 2564	2236	Purchase Inquiry_#466789.exe	30
PID 2236 wrote to memory of 2564	2236	Purchase Inquiry_#466789.exe	30
PID 2236 wrote to memory of 2648	2236	Purchase Inquiry_#466789.exe	31
PID 2236 wrote to memory of 2648	2236	Purchase Inquiry_#466789.exe	31
PID 2236 wrote to memory of 2648	2236	Purchase Inquiry_#466789.exe	31
PID 2236 wrote to memory of 2648	2236	Purchase Inquiry_#466789.exe	31
PID 2236 wrote to memory of 2664	2236	Purchase Inquiry_#466789.exe	32
PID 2236 wrote to memory of 2664	2236	Purchase Inquiry_#466789.exe	32
PID 2236 wrote to memory of 2664	2236	Purchase Inquiry_#466789.exe	32
PID 2236 wrote to memory of 2664	2236	Purchase Inquiry_#466789.exe	32

C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe"
  2⤵
  PID:3056
- C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe"
  2⤵
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe"
  2⤵
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe"
  2⤵
  PID:2648
- C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe"
  2⤵
  PID:2664

memory/2236-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

Filesize
4KB

Download
memory/2236-1-0x00000000003E0000-0x0000000000464000-memory.dmp

Filesize
528KB

Download
memory/2236-2-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/2236-3-0x0000000001FF0000-0x000000000200A000-memory.dmp

Filesize
104KB

Download
memory/2236-4-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/2236-5-0x00000000049A0000-0x0000000004A02000-memory.dmp

Filesize
392KB

Download
memory/2236-6-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download