ae959b50f65f4597365f2aedd8c7b1e03a8319bd17f87fbd9dda7afc4f610a59

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 07:30

Target

Alesto.exe
Size

134KB
MD5

f9ced9634101aaa2dd0d90fe61ea17e4
SHA1

55218280a9678d334035e070ce7451aab0827f07
SHA256

4894b24b23a85fa09f9f27d4ba4d904c4eaaba676b04c16cbb8b61e038c42ce3
SHA512

2be536104d3a70f90e6b32e202110fb5f7201aa3601a63866175afa68befaa4e5090e225440f02fbd62088ab3d25c65711a4dba6f5a86dbb2d3b1f21f5e91925
SSDEEP

1536:Gy4fa9f5iiw76xIU0LvJJvqJeiRZpyCwwc8maG5qaPXtR6zncSOTPyZnCKZ7rbhS:GyzO4iqu8TAXtQncSO3R45n

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	Alesto.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2688	2492	Alesto.exe	30
PID 2492 wrote to memory of 2688	2492	Alesto.exe	30
PID 2492 wrote to memory of 2688	2492	Alesto.exe	30
PID 2492 wrote to memory of 2688	2492	Alesto.exe	30
PID 2492 wrote to memory of 2708	2492	Alesto.exe	31
PID 2492 wrote to memory of 2708	2492	Alesto.exe	31
PID 2492 wrote to memory of 2708	2492	Alesto.exe	31
PID 2492 wrote to memory of 2708	2492	Alesto.exe	31
PID 2492 wrote to memory of 2832	2492	Alesto.exe	32
PID 2492 wrote to memory of 2832	2492	Alesto.exe	32
PID 2492 wrote to memory of 2832	2492	Alesto.exe	32
PID 2492 wrote to memory of 2832	2492	Alesto.exe	32
PID 2492 wrote to memory of 2860	2492	Alesto.exe	33
PID 2492 wrote to memory of 2860	2492	Alesto.exe	33
PID 2492 wrote to memory of 2860	2492	Alesto.exe	33
PID 2492 wrote to memory of 2860	2492	Alesto.exe	33
PID 2492 wrote to memory of 2828	2492	Alesto.exe	34
PID 2492 wrote to memory of 2828	2492	Alesto.exe	34
PID 2492 wrote to memory of 2828	2492	Alesto.exe	34
PID 2492 wrote to memory of 2828	2492	Alesto.exe	34

C:\Users\Admin\AppData\Local\Temp\Alesto.exe
"C:\Users\Admin\AppData\Local\Temp\Alesto.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2828

memory/2492-0-0x000007FEF56A3000-0x000007FEF56A4000-memory.dmp

Filesize
4KB

Download
memory/2492-1-0x0000000000DC0000-0x0000000000DE6000-memory.dmp

Filesize
152KB

Download
memory/2492-16-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

Filesize
40KB

Download