b561c4f11b060fb17505736a77526d955e53d6dc15baf6874acd72c8e19ee16c

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 02:36

Target

b561c4f11b060fb17505736a77526d955e53d6dc15baf6874acd72c8e19ee16c.exe
Size

451KB
MD5

8116e9bbbd58b66fb46d3ba3c085a3e6
SHA1

77bb9c3c11aea3504f2475f0105f2c44106955cd
SHA256

b561c4f11b060fb17505736a77526d955e53d6dc15baf6874acd72c8e19ee16c
SHA512

0c081e00c08928a6350688e1528a1f456fc00aa61ea3bd0f4230a23c8acd8bebc0b720199c663ae83a8e6327020d44493acaef1e1093a650153f424d83c65fb4
SSDEEP

12288:mHq8aKXCt17UcENYXLhIeJKx/YKSJ5vHO6jm7IGsmxQ:mqt17UzNYXLP8/YKWu6O/smC

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3852	b561c4f11b060fb17505736a77526d955e53d6dc15baf6874acd72c8e19ee16c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3852	b561c4f11b060fb17505736a77526d955e53d6dc15baf6874acd72c8e19ee16c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 1652	3852	b561c4f11b060fb17505736a77526d955e53d6dc15baf6874acd72c8e19ee16c.exe	80
PID 3852 wrote to memory of 1652	3852	b561c4f11b060fb17505736a77526d955e53d6dc15baf6874acd72c8e19ee16c.exe	80
PID 3852 wrote to memory of 1652	3852	b561c4f11b060fb17505736a77526d955e53d6dc15baf6874acd72c8e19ee16c.exe	80

C:\Users\Admin\AppData\Local\Temp\b561c4f11b060fb17505736a77526d955e53d6dc15baf6874acd72c8e19ee16c.exe
"C:\Users\Admin\AppData\Local\Temp\b561c4f11b060fb17505736a77526d955e53d6dc15baf6874acd72c8e19ee16c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\B561C4~1.EXE
  2⤵
  PID:1652

memory/3852-134-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3852-136-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download