91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 14:48

Target

91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
Size

16KB
MD5

bf7fe6eb5bb1370037fb32f2ca3af19d
SHA1

e84b45ef4672259fa6ba963c1d49683343c4e1dd
SHA256

91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755
SHA512

0ac27873c53bbac3e3b108b282f848a61638c17ec3ca4effa9e477e19a48661bb79671f87ab28cb7fcb5595e4908cde4362711f7487abffca483f0799524e33f
SSDEEP

384:rEfOryV5/k95TsZmLMN8GuTs0sg7UVOmhXpTV7qfOA:rFCA4gtsBhXpTpBA

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2408	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	30
PID 2920 wrote to memory of 2408	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	30
PID 2920 wrote to memory of 2408	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	30
PID 2920 wrote to memory of 2408	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	30
PID 2920 wrote to memory of 1800	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	31
PID 2920 wrote to memory of 1800	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	31
PID 2920 wrote to memory of 1800	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	31
PID 2920 wrote to memory of 1800	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	31
PID 2920 wrote to memory of 2228	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	32
PID 2920 wrote to memory of 2228	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	32
PID 2920 wrote to memory of 2228	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	32
PID 2920 wrote to memory of 2228	2920	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	32

C:\Users\Admin\AppData\Local\Temp\91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
"C:\Users\Admin\AppData\Local\Temp\91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2228

memory/2920-0-0x000007FEF5713000-0x000007FEF5714000-memory.dmp

Filesize
4KB

Download
memory/2920-1-0x000000013F700000-0x000000013F708000-memory.dmp

Filesize
32KB

Download
memory/2920-2-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2920-3-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download