c191d4268f7f39aaeec5069c2e7431b76091ecbc77b527df069504c1ea50dad2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 01:46

Target

SOA Payment for June 30th.exe
Size

806KB
MD5

63128eeca6e0dabeddfd68c0517d4c91
SHA1

eb43eb41464d255d312b6b2aa14428ccd16156da
SHA256

45d0c2ec2ede02e8b8ef535346a4e7e06fd52ba27995a15a5f1a0b11e305d4f7
SHA512

73fabc52ee53b8ab3e70006c058ad6718b00cdc8259eccb7e545e7223d1cff7f84d670788484b6fdb59ef4930162d0ccbe83f2af4f1ab9fdc3d0577e9a767547
SSDEEP

12288:dLYjofC1PHG1ub2dwZEWBMlQrpNO4904kZwB2JYoUev4y1VJznHhtbKOVDyTVoy:+1m1utZqi9gI0qB2JYofQOznHhhKGy

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	SOA Payment for June 30th.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2796	2800	SOA Payment for June 30th.exe	28
PID 2800 wrote to memory of 2796	2800	SOA Payment for June 30th.exe	28
PID 2800 wrote to memory of 2796	2800	SOA Payment for June 30th.exe	28
PID 2800 wrote to memory of 2796	2800	SOA Payment for June 30th.exe	28
PID 2800 wrote to memory of 2636	2800	SOA Payment for June 30th.exe	29
PID 2800 wrote to memory of 2636	2800	SOA Payment for June 30th.exe	29
PID 2800 wrote to memory of 2636	2800	SOA Payment for June 30th.exe	29
PID 2800 wrote to memory of 2636	2800	SOA Payment for June 30th.exe	29
PID 2800 wrote to memory of 2744	2800	SOA Payment for June 30th.exe	30
PID 2800 wrote to memory of 2744	2800	SOA Payment for June 30th.exe	30
PID 2800 wrote to memory of 2744	2800	SOA Payment for June 30th.exe	30
PID 2800 wrote to memory of 2744	2800	SOA Payment for June 30th.exe	30
PID 2800 wrote to memory of 1940	2800	SOA Payment for June 30th.exe	31
PID 2800 wrote to memory of 1940	2800	SOA Payment for June 30th.exe	31
PID 2800 wrote to memory of 1940	2800	SOA Payment for June 30th.exe	31
PID 2800 wrote to memory of 1940	2800	SOA Payment for June 30th.exe	31
PID 2800 wrote to memory of 2104	2800	SOA Payment for June 30th.exe	32
PID 2800 wrote to memory of 2104	2800	SOA Payment for June 30th.exe	32
PID 2800 wrote to memory of 2104	2800	SOA Payment for June 30th.exe	32
PID 2800 wrote to memory of 2104	2800	SOA Payment for June 30th.exe	32

C:\Users\Admin\AppData\Local\Temp\SOA Payment for June 30th.exe
"C:\Users\Admin\AppData\Local\Temp\SOA Payment for June 30th.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\SOA Payment for June 30th.exe
  "C:\Users\Admin\AppData\Local\Temp\SOA Payment for June 30th.exe"
  2⤵
  PID:2796
- C:\Users\Admin\AppData\Local\Temp\SOA Payment for June 30th.exe
  "C:\Users\Admin\AppData\Local\Temp\SOA Payment for June 30th.exe"
  2⤵
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\SOA Payment for June 30th.exe
  "C:\Users\Admin\AppData\Local\Temp\SOA Payment for June 30th.exe"
  2⤵
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\SOA Payment for June 30th.exe
  "C:\Users\Admin\AppData\Local\Temp\SOA Payment for June 30th.exe"
  2⤵
  PID:1940
- C:\Users\Admin\AppData\Local\Temp\SOA Payment for June 30th.exe
  "C:\Users\Admin\AppData\Local\Temp\SOA Payment for June 30th.exe"
  2⤵
  PID:2104

memory/2800-0-0x000000007480E000-0x000000007480F000-memory.dmp

Filesize
4KB

Download
memory/2800-1-0x00000000003D0000-0x00000000004A0000-memory.dmp

Filesize
832KB

Download
memory/2800-2-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download
memory/2800-3-0x00000000003B0000-0x00000000003CA000-memory.dmp

Filesize
104KB

Download
memory/2800-4-0x0000000000370000-0x0000000000378000-memory.dmp

Filesize
32KB

Download
memory/2800-5-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/2800-6-0x0000000005110000-0x0000000005194000-memory.dmp

Filesize
528KB

Download
memory/2800-7-0x0000000074800000-0x0000000074EEE000-memory.dmp

Filesize
6.9MB

Download