3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
18-06-2024 06:26

Target

9944072139960c547ca-273a.exe
Size

503KB
MD5

51f1fee73b718b767fce1ef9c33b1faa
SHA1

25631c3c8a52166dfa46db1d57f4acca4a38546f
SHA256

3ef6748718e356e17a6edc5b7e60784c6ca011748421b0163ef3ab43741260f8
SHA512

1e4c45e7aa2951c0d4258b909ca062ed16148b4fce5a14bf5277fd1c5781ccbfceec333efdc236ba5cc9ec12082913199b524b2df67292b1abe3478bbafe8b8d
SSDEEP

6144:fij2hYUvFIsP3Qm5cedrtLioM33dGON9ANms1XqZMr+hkEZVOdT+B0FlDwuJk6UD:rFIsPAedrR9acg9mq2CvAdK/lIb

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1252	9944072139960c547ca-273a.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2740	1252	9944072139960c547ca-273a.exe	28
PID 1252 wrote to memory of 2740	1252	9944072139960c547ca-273a.exe	28
PID 1252 wrote to memory of 2740	1252	9944072139960c547ca-273a.exe	28
PID 1252 wrote to memory of 2740	1252	9944072139960c547ca-273a.exe	28
PID 1252 wrote to memory of 2756	1252	9944072139960c547ca-273a.exe	29
PID 1252 wrote to memory of 2756	1252	9944072139960c547ca-273a.exe	29
PID 1252 wrote to memory of 2756	1252	9944072139960c547ca-273a.exe	29
PID 1252 wrote to memory of 2756	1252	9944072139960c547ca-273a.exe	29
PID 1252 wrote to memory of 2864	1252	9944072139960c547ca-273a.exe	30
PID 1252 wrote to memory of 2864	1252	9944072139960c547ca-273a.exe	30
PID 1252 wrote to memory of 2864	1252	9944072139960c547ca-273a.exe	30
PID 1252 wrote to memory of 2864	1252	9944072139960c547ca-273a.exe	30
PID 1252 wrote to memory of 2656	1252	9944072139960c547ca-273a.exe	31
PID 1252 wrote to memory of 2656	1252	9944072139960c547ca-273a.exe	31
PID 1252 wrote to memory of 2656	1252	9944072139960c547ca-273a.exe	31
PID 1252 wrote to memory of 2656	1252	9944072139960c547ca-273a.exe	31
PID 1252 wrote to memory of 3036	1252	9944072139960c547ca-273a.exe	32
PID 1252 wrote to memory of 3036	1252	9944072139960c547ca-273a.exe	32
PID 1252 wrote to memory of 3036	1252	9944072139960c547ca-273a.exe	32
PID 1252 wrote to memory of 3036	1252	9944072139960c547ca-273a.exe	32

C:\Users\Admin\AppData\Local\Temp\9944072139960c547ca-273a.exe
"C:\Users\Admin\AppData\Local\Temp\9944072139960c547ca-273a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\9944072139960c547ca-273a.exe
  "C:\Users\Admin\AppData\Local\Temp\9944072139960c547ca-273a.exe"
  2⤵
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\9944072139960c547ca-273a.exe
  "C:\Users\Admin\AppData\Local\Temp\9944072139960c547ca-273a.exe"
  2⤵
  PID:2756
- C:\Users\Admin\AppData\Local\Temp\9944072139960c547ca-273a.exe
  "C:\Users\Admin\AppData\Local\Temp\9944072139960c547ca-273a.exe"
  2⤵
  PID:2864
- C:\Users\Admin\AppData\Local\Temp\9944072139960c547ca-273a.exe
  "C:\Users\Admin\AppData\Local\Temp\9944072139960c547ca-273a.exe"
  2⤵
  PID:2656
- C:\Users\Admin\AppData\Local\Temp\9944072139960c547ca-273a.exe
  "C:\Users\Admin\AppData\Local\Temp\9944072139960c547ca-273a.exe"
  2⤵
  PID:3036

memory/1252-0-0x0000000074E8E000-0x0000000074E8F000-memory.dmp

Filesize
4KB

Download
memory/1252-1-0x0000000000380000-0x0000000000404000-memory.dmp

Filesize
528KB

Download
memory/1252-2-0x0000000074E80000-0x000000007556E000-memory.dmp

Filesize
6.9MB

Download
memory/1252-3-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/1252-4-0x0000000000540000-0x0000000000548000-memory.dmp

Filesize
32KB

Download
memory/1252-5-0x0000000000550000-0x000000000055C000-memory.dmp

Filesize
48KB

Download
memory/1252-6-0x0000000002230000-0x0000000002292000-memory.dmp

Filesize
392KB

Download
memory/1252-7-0x0000000074E80000-0x000000007556E000-memory.dmp

Filesize
6.9MB

Download