4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390

General

Target

4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe
Size

108KB
MD5

45e1f17158de78fe84e61450678236c1
SHA1

81a8064a79805cdb9e47658cc5944ad04f7de100
SHA256

4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390
SHA512

f747ca641be2f440e38007abc026fc57fa56a255a7e50dcac996c82d5c85fe974c430c80d2b1e9dec4a94f8dbd5c23475ce06d58de21f0acb596b9a362b86b3c
SSDEEP

1536:E3vQ2Vo984tJ32d0zxBty01AGtNAjvpJla938l49V/Y2AeI+CukCToN:4vr34tQdUrty0lNAjvpJY/Y2AeI+uC

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe
2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe
2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe
2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe
2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe
2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe
2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe
2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe
2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe
2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2084	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	30
PID 2464 wrote to memory of 2084	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	30
PID 2464 wrote to memory of 2084	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	30
PID 2464 wrote to memory of 2084	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	30
PID 2464 wrote to memory of 2152	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	31
PID 2464 wrote to memory of 2152	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	31
PID 2464 wrote to memory of 2152	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	31
PID 2464 wrote to memory of 2152	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	31
PID 2464 wrote to memory of 2080	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	32
PID 2464 wrote to memory of 2080	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	32
PID 2464 wrote to memory of 2080	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	32
PID 2464 wrote to memory of 2080	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	32
PID 2464 wrote to memory of 824	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	33
PID 2464 wrote to memory of 824	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	33
PID 2464 wrote to memory of 824	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	33
PID 2464 wrote to memory of 824	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	33
PID 2464 wrote to memory of 2772	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	34
PID 2464 wrote to memory of 2772	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	34
PID 2464 wrote to memory of 2772	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	34
PID 2464 wrote to memory of 2772	2464	4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe	34

C:\Users\Admin\AppData\Local\Temp\4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe
"C:\Users\Admin\AppData\Local\Temp\4508478f72d7aadcdaa5a076cee956fcf96eff8987bc77063bee1c7a8d0f8390.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2464-0-0x000007FEF5AB3000-0x000007FEF5AB4000-memory.dmp

Filesize
4KB

Download
memory/2464-1-0x0000000000880000-0x00000000008A0000-memory.dmp

Filesize
128KB

Download
memory/2464-2-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download
memory/2464-3-0x0000000000140000-0x000000000014A000-memory.dmp

Filesize
40KB

Download
memory/2464-4-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads