6dbe9a6e92e3962725c30e1533f195da33329b089a537557b1c3571225969191

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 09:11

Target

PO#34316_20240528.exe
Size

535KB
MD5

14510710e98b064e69ecb55e956b2efe
SHA1

8e4a25f4b78a9293e39bcfb67686e0e0a4e5873a
SHA256

6dbe9a6e92e3962725c30e1533f195da33329b089a537557b1c3571225969191
SHA512

76b3116a1deae0c18add797a8c078fa621303292abaeefcef3eb67e01ae2ea21945a272936a356e17bd4ac17b809b05fd6c90da6b67126bcf3827b5496789363
SSDEEP

12288:+KcAV/xf4MbNpcFC1f41Vk6EjRlHs4vBqzkR:HOC1okFjHs453

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	PO#34316_20240528.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2520	1556	PO#34316_20240528.exe	28
PID 1556 wrote to memory of 2520	1556	PO#34316_20240528.exe	28
PID 1556 wrote to memory of 2520	1556	PO#34316_20240528.exe	28
PID 1556 wrote to memory of 2520	1556	PO#34316_20240528.exe	28
PID 1556 wrote to memory of 2564	1556	PO#34316_20240528.exe	29
PID 1556 wrote to memory of 2564	1556	PO#34316_20240528.exe	29
PID 1556 wrote to memory of 2564	1556	PO#34316_20240528.exe	29
PID 1556 wrote to memory of 2564	1556	PO#34316_20240528.exe	29
PID 1556 wrote to memory of 2568	1556	PO#34316_20240528.exe	30
PID 1556 wrote to memory of 2568	1556	PO#34316_20240528.exe	30
PID 1556 wrote to memory of 2568	1556	PO#34316_20240528.exe	30
PID 1556 wrote to memory of 2568	1556	PO#34316_20240528.exe	30
PID 1556 wrote to memory of 2600	1556	PO#34316_20240528.exe	31
PID 1556 wrote to memory of 2600	1556	PO#34316_20240528.exe	31
PID 1556 wrote to memory of 2600	1556	PO#34316_20240528.exe	31
PID 1556 wrote to memory of 2600	1556	PO#34316_20240528.exe	31
PID 1556 wrote to memory of 2604	1556	PO#34316_20240528.exe	32
PID 1556 wrote to memory of 2604	1556	PO#34316_20240528.exe	32
PID 1556 wrote to memory of 2604	1556	PO#34316_20240528.exe	32
PID 1556 wrote to memory of 2604	1556	PO#34316_20240528.exe	32

C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe
"C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe"
  2⤵
  PID:2520
- C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe"
  2⤵
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe"
  2⤵
  PID:2568
- C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe"
  2⤵
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe"
  2⤵
  PID:2604

memory/1556-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Filesize
4KB

Download
memory/1556-1-0x0000000000200000-0x0000000000288000-memory.dmp

Filesize
544KB

Download
memory/1556-2-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/1556-3-0x0000000000370000-0x0000000000386000-memory.dmp

Filesize
88KB

Download
memory/1556-4-0x0000000000610000-0x000000000061C000-memory.dmp

Filesize
48KB

Download
memory/1556-5-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/1556-6-0x0000000004F40000-0x0000000004FA2000-memory.dmp

Filesize
392KB

Download
memory/1556-7-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download