bd028b3daec028006011e388902074f0a7338b205e46a5d81f0a0c304011ba9c

Analysis

max time kernel
168s
max time network
174s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 07:37

Target

bd028b3daec028006011e388902074f0a7338b205e46a5d81f0a0c304011ba9c.exe
Size

97KB
MD5

eb72866b7d9fd03fc0d6054662686b7c
SHA1

eb2fcd8336237346bae966fe71e7eab0ddab32aa
SHA256

bd028b3daec028006011e388902074f0a7338b205e46a5d81f0a0c304011ba9c
SHA512

41b3efdfa84f6c934406fd7931cc7f3fe706fc9470ccfd34881edfcb49ee442ce777a36202da7d374058b30c73fec1826a6eea0861bc70eadbef31a287652875
SSDEEP

1536:51IjsLmIDpsg34biwAz90VbNj7tdAzXof1tqkzOO5cSi4iXHifKvtotj:5ajsbSgKAz9CdAzXE1YXPOKvtotj

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
1064	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1064	968	bd028b3daec028006011e388902074f0a7338b205e46a5d81f0a0c304011ba9c.exe	28
PID 968 wrote to memory of 1064	968	bd028b3daec028006011e388902074f0a7338b205e46a5d81f0a0c304011ba9c.exe	28
PID 968 wrote to memory of 1064	968	bd028b3daec028006011e388902074f0a7338b205e46a5d81f0a0c304011ba9c.exe	28
PID 968 wrote to memory of 1064	968	bd028b3daec028006011e388902074f0a7338b205e46a5d81f0a0c304011ba9c.exe	28

C:\Users\Admin\AppData\Local\Temp\bd028b3daec028006011e388902074f0a7338b205e46a5d81f0a0c304011ba9c.exe
"C:\Users\Admin\AppData\Local\Temp\bd028b3daec028006011e388902074f0a7338b205e46a5d81f0a0c304011ba9c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /F /IM MSASCui.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1064

memory/968-54-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/968-56-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/968-57-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/968-58-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download