0d14aa04495533f14f8e95994bde686ee53be4ef3665dc951297ffd9d1863bee

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 14:09

Target

SC_TR23052024.exe
Size

754KB
MD5

8ed6f5c578a44b191a187624c4664d7b
SHA1

834a8dd27f54f9c35045e34d8c0ac604516a3e12
SHA256

fb94701002816ee47f78f3712fef111cb1e16aba754f1df4a9796746b836a39e
SHA512

fa5e083b4480e329bf61cfa8e5faf1e4eed2d71c35c2422a3a5e267120b6087142d3cc569517957e7352d15f47a9977bf16e410e83fe78e166f1d441e028fd99
SSDEEP

12288:b8+Ep9UQ8JibdmHrwOPLDbK8+FpeIdJqkR:b85p9UfIbULDbEeIdH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	SC_TR23052024.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2108	2348	SC_TR23052024.exe	28
PID 2348 wrote to memory of 2108	2348	SC_TR23052024.exe	28
PID 2348 wrote to memory of 2108	2348	SC_TR23052024.exe	28
PID 2348 wrote to memory of 2108	2348	SC_TR23052024.exe	28
PID 2348 wrote to memory of 2852	2348	SC_TR23052024.exe	29
PID 2348 wrote to memory of 2852	2348	SC_TR23052024.exe	29
PID 2348 wrote to memory of 2852	2348	SC_TR23052024.exe	29
PID 2348 wrote to memory of 2852	2348	SC_TR23052024.exe	29
PID 2348 wrote to memory of 2560	2348	SC_TR23052024.exe	30
PID 2348 wrote to memory of 2560	2348	SC_TR23052024.exe	30
PID 2348 wrote to memory of 2560	2348	SC_TR23052024.exe	30
PID 2348 wrote to memory of 2560	2348	SC_TR23052024.exe	30
PID 2348 wrote to memory of 2324	2348	SC_TR23052024.exe	31
PID 2348 wrote to memory of 2324	2348	SC_TR23052024.exe	31
PID 2348 wrote to memory of 2324	2348	SC_TR23052024.exe	31
PID 2348 wrote to memory of 2324	2348	SC_TR23052024.exe	31
PID 2348 wrote to memory of 1556	2348	SC_TR23052024.exe	32
PID 2348 wrote to memory of 1556	2348	SC_TR23052024.exe	32
PID 2348 wrote to memory of 1556	2348	SC_TR23052024.exe	32
PID 2348 wrote to memory of 1556	2348	SC_TR23052024.exe	32

C:\Users\Admin\AppData\Local\Temp\SC_TR23052024.exe
"C:\Users\Admin\AppData\Local\Temp\SC_TR23052024.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\SC_TR23052024.exe
  "C:\Users\Admin\AppData\Local\Temp\SC_TR23052024.exe"
  2⤵
  PID:2108
- C:\Users\Admin\AppData\Local\Temp\SC_TR23052024.exe
  "C:\Users\Admin\AppData\Local\Temp\SC_TR23052024.exe"
  2⤵
  PID:2852
- C:\Users\Admin\AppData\Local\Temp\SC_TR23052024.exe
  "C:\Users\Admin\AppData\Local\Temp\SC_TR23052024.exe"
  2⤵
  PID:2560
- C:\Users\Admin\AppData\Local\Temp\SC_TR23052024.exe
  "C:\Users\Admin\AppData\Local\Temp\SC_TR23052024.exe"
  2⤵
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\SC_TR23052024.exe
  "C:\Users\Admin\AppData\Local\Temp\SC_TR23052024.exe"
  2⤵
  PID:1556

memory/2348-0-0x000000007412E000-0x000000007412F000-memory.dmp

Filesize
4KB

Download
memory/2348-1-0x0000000000290000-0x0000000000350000-memory.dmp

Filesize
768KB

Download
memory/2348-2-0x0000000000610000-0x000000000062A000-memory.dmp

Filesize
104KB

Download
memory/2348-3-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/2348-4-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/2348-5-0x00000000022B0000-0x0000000002312000-memory.dmp

Filesize
392KB

Download
memory/2348-6-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download