e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 05:06

Target

eyIFanijo.exe
Size

147KB
MD5

a06d563641bb76a56d398568ea0e9795
SHA1

dc81eb51de4d8ffbf0bbbcbdb3f3c6980d09e416
SHA256

e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54
SHA512

a1beb17ff9486409f5a1f38b63e57a5ea3e5a66fca45e832b8671c738378379d5a459a883bde9f1bd98346350e39c3a22971f373e02defa4e822e4d12d6d0913
SSDEEP

3072:n808ghSE5bkWp6aKeGn+Yembgy04MT97:8MhD5bTuevydW

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	eyIFanijo.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2744	1308	eyIFanijo.exe	30
PID 1308 wrote to memory of 2744	1308	eyIFanijo.exe	30
PID 1308 wrote to memory of 2744	1308	eyIFanijo.exe	30
PID 1308 wrote to memory of 2744	1308	eyIFanijo.exe	30
PID 1308 wrote to memory of 2760	1308	eyIFanijo.exe	31
PID 1308 wrote to memory of 2760	1308	eyIFanijo.exe	31
PID 1308 wrote to memory of 2760	1308	eyIFanijo.exe	31
PID 1308 wrote to memory of 2760	1308	eyIFanijo.exe	31
PID 1308 wrote to memory of 2804	1308	eyIFanijo.exe	32
PID 1308 wrote to memory of 2804	1308	eyIFanijo.exe	32
PID 1308 wrote to memory of 2804	1308	eyIFanijo.exe	32
PID 1308 wrote to memory of 2804	1308	eyIFanijo.exe	32
PID 1308 wrote to memory of 2800	1308	eyIFanijo.exe	33
PID 1308 wrote to memory of 2800	1308	eyIFanijo.exe	33
PID 1308 wrote to memory of 2800	1308	eyIFanijo.exe	33
PID 1308 wrote to memory of 2800	1308	eyIFanijo.exe	33
PID 1308 wrote to memory of 2944	1308	eyIFanijo.exe	34
PID 1308 wrote to memory of 2944	1308	eyIFanijo.exe	34
PID 1308 wrote to memory of 2944	1308	eyIFanijo.exe	34
PID 1308 wrote to memory of 2944	1308	eyIFanijo.exe	34

C:\Users\Admin\AppData\Local\Temp\eyIFanijo.exe
"C:\Users\Admin\AppData\Local\Temp\eyIFanijo.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2944

memory/1308-0-0x000007FEF60C3000-0x000007FEF60C4000-memory.dmp

Filesize
4KB

Download
memory/1308-1-0x0000000000090000-0x00000000000BA000-memory.dmp

Filesize
168KB

Download
memory/1308-2-0x000007FEF60C0000-0x000007FEF6AAC000-memory.dmp

Filesize
9.9MB

Download
memory/1308-3-0x0000000000430000-0x000000000043A000-memory.dmp

Filesize
40KB

Download
memory/1308-4-0x000007FEF60C0000-0x000007FEF6AAC000-memory.dmp

Filesize
9.9MB

Download