Analysis
-
max time kernel
93s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 01:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe
-
Size
1.3MB
-
MD5
062080eeb82fd1ecd2bace697a0cd9df
-
SHA1
cae1f6ab41912aa623aa7725481b6a4e4419b7ac
-
SHA256
88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22
-
SHA512
a2c28a79c1f9b98efd5fad07a7cb8f13bd8bd87867700a97381aab563f1072a124799e6185e6298ade4b984dc42cc7febcdb8689640c5c5a855dc3620e92f389
-
SSDEEP
24576:ykDALjFf+flXChb0QHT5KBDqpZaSOMrCY37Whz/+mxWj5:4iChAQz5KsNK6W5/Fx0
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3384 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88 PID 4528 wrote to memory of 3384 4528 88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe"C:\Users\Admin\AppData\Local\Temp\88a404c631aed90145091d17f3e1e34d5936051c1353a529448419f0098dff22.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:3384
-