62483d2aa3150c294a65b4944fdf4d6aabf46697e42ab0e011efe92cbca50aaa

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 14:11

Target

Bitmap2_GDIOnly.exe
Size

448KB
MD5

c99931701b5c04023f64c2204056756a
SHA1

131af8d2eeec1116f2c1b6e293a6eb4712b6804d
SHA256

62483d2aa3150c294a65b4944fdf4d6aabf46697e42ab0e011efe92cbca50aaa
SHA512

3191fef7e441ec9990bf8d6c380e13187b010d7d6623452c48cf8d7f3af18f1dee4022cf6d32dadce1116a1f44553fca6af417465133b50fad32f11f91e4e189
SSDEEP

3072:jJNzSBdCGPVHzzgd2HPVVf9AebuLFfK9s7I/mkltK4L6INgDd9Zqi3lhai6ae8Y:jr0rak9gorrUq6ci3l68

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	Bitmap2_GDIOnly.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 700	3036	Bitmap2_GDIOnly.exe	31
PID 3036 wrote to memory of 700	3036	Bitmap2_GDIOnly.exe	31
PID 3036 wrote to memory of 700	3036	Bitmap2_GDIOnly.exe	31

C:\Users\Admin\AppData\Local\Temp\Bitmap2_GDIOnly.exe
"C:\Users\Admin\AppData\Local\Temp\Bitmap2_GDIOnly.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 868
  2⤵
  PID:700

memory/700-3-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/3036-0-0x000007FEF645E000-0x000007FEF645F000-memory.dmp

Filesize
4KB

Download
memory/3036-1-0x000007FEF61A0000-0x000007FEF6B3D000-memory.dmp

Filesize
9.6MB

Download
memory/3036-2-0x000007FEF61A0000-0x000007FEF6B3D000-memory.dmp

Filesize
9.6MB

Download
memory/3036-4-0x000007FEF61A0000-0x000007FEF6B3D000-memory.dmp

Filesize
9.6MB

Download
memory/3036-5-0x0000000001F10000-0x0000000001F90000-memory.dmp

Filesize
512KB

Download
memory/3036-6-0x0000000001F10000-0x0000000001F90000-memory.dmp

Filesize
512KB

Download