e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 05:08

Target

eyIFanijo.exe
Size

147KB
MD5

a06d563641bb76a56d398568ea0e9795
SHA1

dc81eb51de4d8ffbf0bbbcbdb3f3c6980d09e416
SHA256

e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54
SHA512

a1beb17ff9486409f5a1f38b63e57a5ea3e5a66fca45e832b8671c738378379d5a459a883bde9f1bd98346350e39c3a22971f373e02defa4e822e4d12d6d0913
SSDEEP

3072:n808ghSE5bkWp6aKeGn+Yembgy04MT97:8MhD5bTuevydW

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	eyIFanijo.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2576	1368	eyIFanijo.exe	31
PID 1368 wrote to memory of 2576	1368	eyIFanijo.exe	31
PID 1368 wrote to memory of 2576	1368	eyIFanijo.exe	31
PID 1368 wrote to memory of 2576	1368	eyIFanijo.exe	31
PID 1368 wrote to memory of 1216	1368	eyIFanijo.exe	32
PID 1368 wrote to memory of 1216	1368	eyIFanijo.exe	32
PID 1368 wrote to memory of 1216	1368	eyIFanijo.exe	32
PID 1368 wrote to memory of 1216	1368	eyIFanijo.exe	32
PID 1368 wrote to memory of 2716	1368	eyIFanijo.exe	33
PID 1368 wrote to memory of 2716	1368	eyIFanijo.exe	33
PID 1368 wrote to memory of 2716	1368	eyIFanijo.exe	33
PID 1368 wrote to memory of 2716	1368	eyIFanijo.exe	33
PID 1368 wrote to memory of 2968	1368	eyIFanijo.exe	34
PID 1368 wrote to memory of 2968	1368	eyIFanijo.exe	34
PID 1368 wrote to memory of 2968	1368	eyIFanijo.exe	34
PID 1368 wrote to memory of 2968	1368	eyIFanijo.exe	34
PID 1368 wrote to memory of 2516	1368	eyIFanijo.exe	35
PID 1368 wrote to memory of 2516	1368	eyIFanijo.exe	35
PID 1368 wrote to memory of 2516	1368	eyIFanijo.exe	35
PID 1368 wrote to memory of 2516	1368	eyIFanijo.exe	35

C:\Users\Admin\AppData\Local\Temp\eyIFanijo.exe
"C:\Users\Admin\AppData\Local\Temp\eyIFanijo.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1216
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2516

memory/1368-0-0x000007FEF6183000-0x000007FEF6184000-memory.dmp

Filesize
4KB

Download
memory/1368-1-0x0000000000CC0000-0x0000000000CEA000-memory.dmp

Filesize
168KB

Download
memory/1368-2-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/1368-3-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

Filesize
40KB

Download
memory/1368-4-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download