e511acb6ee6297e004ee5672a58d408e3c7e2fefaa34e067ef3b6a7ed90f306f

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 14:06

Target
New order 21052024.exe
Size 669KB
Sample240530-redxpsbb2w
SHA256 e511acb6ee6297e004ee5672a58d408e3c7e2fefaa34e067ef3b6a7ed90f306f
MD5 3722bab91535870e9e4cf25acef04f33
SHA1 14ed1edc1f75e918f3fe1abf721296a7c5cd3c17
SHA512 f25a1e4909a457c836db628b064c658076833999c8ea83b6f1781072c7356c00cc73d86152acbaeb96202c9e2e14603d8bb75cce970a7f80edd54714605dfa5e
SSDEEP 12288:rXJQEz0nMPImIc6+JTP1O9avRlQc9XJ2Nyp8LYYnSgd+sLlYZE:uEOMPt6+kA5B+ySUhMHLKG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	848	New order 21052024.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2948	848	New order 21052024.exe	28
PID 848 wrote to memory of 2948	848	New order 21052024.exe	28
PID 848 wrote to memory of 2948	848	New order 21052024.exe	28
PID 848 wrote to memory of 2948	848	New order 21052024.exe	28
PID 848 wrote to memory of 2336	848	New order 21052024.exe	29
PID 848 wrote to memory of 2336	848	New order 21052024.exe	29
PID 848 wrote to memory of 2336	848	New order 21052024.exe	29
PID 848 wrote to memory of 2336	848	New order 21052024.exe	29
PID 848 wrote to memory of 3052	848	New order 21052024.exe	30
PID 848 wrote to memory of 3052	848	New order 21052024.exe	30
PID 848 wrote to memory of 3052	848	New order 21052024.exe	30
PID 848 wrote to memory of 3052	848	New order 21052024.exe	30
PID 848 wrote to memory of 3064	848	New order 21052024.exe	31
PID 848 wrote to memory of 3064	848	New order 21052024.exe	31
PID 848 wrote to memory of 3064	848	New order 21052024.exe	31
PID 848 wrote to memory of 3064	848	New order 21052024.exe	31
PID 848 wrote to memory of 3036	848	New order 21052024.exe	32
PID 848 wrote to memory of 3036	848	New order 21052024.exe	32
PID 848 wrote to memory of 3036	848	New order 21052024.exe	32
PID 848 wrote to memory of 3036	848	New order 21052024.exe	32

C:\Users\Admin\AppData\Local\Temp\New order 21052024.exe
"C:\Users\Admin\AppData\Local\Temp\New order 21052024.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\New order 21052024.exe
  "C:\Users\Admin\AppData\Local\Temp\New order 21052024.exe"
  2⤵
  PID:2948
- C:\Users\Admin\AppData\Local\Temp\New order 21052024.exe
  "C:\Users\Admin\AppData\Local\Temp\New order 21052024.exe"
  2⤵
  PID:2336
- C:\Users\Admin\AppData\Local\Temp\New order 21052024.exe
  "C:\Users\Admin\AppData\Local\Temp\New order 21052024.exe"
  2⤵
  PID:3052
- C:\Users\Admin\AppData\Local\Temp\New order 21052024.exe
  "C:\Users\Admin\AppData\Local\Temp\New order 21052024.exe"
  2⤵
  PID:3064
- C:\Users\Admin\AppData\Local\Temp\New order 21052024.exe
  "C:\Users\Admin\AppData\Local\Temp\New order 21052024.exe"
  2⤵
  PID:3036

memory/848-0-0x000000007425E000-0x000000007425F000-memory.dmp

Download

memory/848-1-0x00000000003A0000-0x000000000044C000-memory.dmp

Download

memory/848-2-0x0000000074250000-0x000000007493E000-memory.dmp

Download

memory/848-3-0x0000000002110000-0x00000000021B2000-memory.dmp

Download

memory/848-4-0x0000000000450000-0x000000000046A000-memory.dmp

Download

memory/848-5-0x0000000000360000-0x0000000000370000-memory.dmp

Download

memory/848-6-0x0000000005350000-0x00000000053D2000-memory.dmp

Download

memory/848-7-0x0000000074250000-0x000000007493E000-memory.dmp

Download