b716ebdbe1fc336fb934f879c1d0966c8aa61ac16d52edf1bc687f9bd1d2dfde

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 18:29

Target

Bm6ssTH5I9vTVqF.exe
Size

526KB
MD5

85bea6e356c3c21984099b9c0dc186e4
SHA1

e52f7214470c9dd0d28dfa0ce75e9f124641276e
SHA256

ed6b6473d09425f88d6ef29939f2eb65e9566b91571d6cb6a366f689d4b667c0
SHA512

7f04f07afdb6a0be86f7fe00b1afd77414620e5df845f99acf8b7b4be6a4298b30bf7fa6f7438e7a8445a31a5aa9d5f9da55ec6f22098078549f3efc7ebeaf93
SSDEEP

12288:qGYBE6fvxnFOjD/JfZX3erjsSE83jpnnqPtxmFy4lpiVw:GlNwNR3erYSx3jtejciVw

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	Bm6ssTH5I9vTVqF.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3052	1988	Bm6ssTH5I9vTVqF.exe	31
PID 1988 wrote to memory of 3052	1988	Bm6ssTH5I9vTVqF.exe	31
PID 1988 wrote to memory of 3052	1988	Bm6ssTH5I9vTVqF.exe	31
PID 1988 wrote to memory of 3052	1988	Bm6ssTH5I9vTVqF.exe	31
PID 1988 wrote to memory of 2208	1988	Bm6ssTH5I9vTVqF.exe	32
PID 1988 wrote to memory of 2208	1988	Bm6ssTH5I9vTVqF.exe	32
PID 1988 wrote to memory of 2208	1988	Bm6ssTH5I9vTVqF.exe	32
PID 1988 wrote to memory of 2208	1988	Bm6ssTH5I9vTVqF.exe	32
PID 1988 wrote to memory of 2740	1988	Bm6ssTH5I9vTVqF.exe	33
PID 1988 wrote to memory of 2740	1988	Bm6ssTH5I9vTVqF.exe	33
PID 1988 wrote to memory of 2740	1988	Bm6ssTH5I9vTVqF.exe	33
PID 1988 wrote to memory of 2740	1988	Bm6ssTH5I9vTVqF.exe	33
PID 1988 wrote to memory of 2728	1988	Bm6ssTH5I9vTVqF.exe	34
PID 1988 wrote to memory of 2728	1988	Bm6ssTH5I9vTVqF.exe	34
PID 1988 wrote to memory of 2728	1988	Bm6ssTH5I9vTVqF.exe	34
PID 1988 wrote to memory of 2728	1988	Bm6ssTH5I9vTVqF.exe	34
PID 1988 wrote to memory of 2756	1988	Bm6ssTH5I9vTVqF.exe	35
PID 1988 wrote to memory of 2756	1988	Bm6ssTH5I9vTVqF.exe	35
PID 1988 wrote to memory of 2756	1988	Bm6ssTH5I9vTVqF.exe	35
PID 1988 wrote to memory of 2756	1988	Bm6ssTH5I9vTVqF.exe	35

C:\Users\Admin\AppData\Local\Temp\Bm6ssTH5I9vTVqF.exe
"C:\Users\Admin\AppData\Local\Temp\Bm6ssTH5I9vTVqF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\Bm6ssTH5I9vTVqF.exe
  "{path}"
  2⤵
  PID:3052
- C:\Users\Admin\AppData\Local\Temp\Bm6ssTH5I9vTVqF.exe
  "{path}"
  2⤵
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\Bm6ssTH5I9vTVqF.exe
  "{path}"
  2⤵
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\Bm6ssTH5I9vTVqF.exe
  "{path}"
  2⤵
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\Bm6ssTH5I9vTVqF.exe
  "{path}"
  2⤵
  PID:2756

memory/1988-0-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download
memory/1988-1-0x0000000000380000-0x000000000040A000-memory.dmp

Filesize
552KB

Download
memory/1988-2-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/1988-3-0x00000000005D0000-0x00000000005E2000-memory.dmp

Filesize
72KB

Download
memory/1988-4-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download
memory/1988-5-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/1988-6-0x0000000005DF0000-0x0000000005E68000-memory.dmp

Filesize
480KB

Download
memory/1988-7-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download