4e694e6ec7079b1259abce8bcd4b7da0151a941eb6e1aac684d13e351492b9cd

Analysis

max time kernel
150s
max time network
47s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
20-07-2022 17:42

Target

4e694e6ec7079b1259abce8bcd4b7da0151a941eb6e1aac684d13e351492b9cd.exe
Size

17KB
MD5

97b17a58d9327c58363e3ed885ca1435
SHA1

fb03ccaac36a0994a5ef44906f5ae3615e500ebb
SHA256

4e694e6ec7079b1259abce8bcd4b7da0151a941eb6e1aac684d13e351492b9cd
SHA512

0e27bd8dfaa7f0d5244c7a5931e31484d194ec780a511609b5d7406d35ed76c7a6fa772b29d01fea2d26887603cc1dc6b16e60b30b9b5d12219dd6c11bf627be

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1648 powershell.exe

pid	process
1648	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4e694e6ec7079b1259abce8bcd4b7da0151a941eb6e1aac684d13e351492b9cd.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1020	4e694e6ec7079b1259abce8bcd4b7da0151a941eb6e1aac684d13e351492b9cd.exe
Token: SeDebugPrivilege	1648	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4e694e6ec7079b1259abce8bcd4b7da0151a941eb6e1aac684d13e351492b9cd.exe

description	pid	process	target process
PID 1020 wrote to memory of 1648	1020	4e694e6ec7079b1259abce8bcd4b7da0151a941eb6e1aac684d13e351492b9cd.exe	powershell.exe
PID 1020 wrote to memory of 1648	1020	4e694e6ec7079b1259abce8bcd4b7da0151a941eb6e1aac684d13e351492b9cd.exe	powershell.exe
PID 1020 wrote to memory of 1648	1020	4e694e6ec7079b1259abce8bcd4b7da0151a941eb6e1aac684d13e351492b9cd.exe	powershell.exe

memory/1020-54-0x000007FEF3880000-0x000007FEF42A3000-memory.dmp

Filesize
10.1MB

Download
memory/1020-55-0x000007FEF27E0000-0x000007FEF3876000-memory.dmp

Filesize
16.6MB

Download
memory/1648-56-0x0000000000000000-mapping.dmp

Download
memory/1648-57-0x000007FEFBC71000-0x000007FEFBC73000-memory.dmp

Filesize
8KB

Download
memory/1648-58-0x000007FEF3880000-0x000007FEF42A3000-memory.dmp

Filesize
10.1MB

Download
memory/1648-60-0x00000000024E4000-0x00000000024E7000-memory.dmp

Filesize
12KB

Download
memory/1648-59-0x000007FEEE030000-0x000007FEEEB8D000-memory.dmp

Filesize
11.4MB

Download
memory/1648-61-0x000007FEF27E0000-0x000007FEF3876000-memory.dmp

Filesize
16.6MB

Download
memory/1648-62-0x00000000024EB000-0x000000000250A000-memory.dmp

Filesize
124KB

Download
memory/1648-63-0x00000000024E4000-0x00000000024E7000-memory.dmp

Filesize
12KB

Download
memory/1648-64-0x00000000024EB000-0x000000000250A000-memory.dmp

Filesize
124KB

Download