502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 22:46

Target

502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe
Size

48KB
MD5

00c8de3074534835cab8e3fb7491e2d0
SHA1

d9e23e9590135b515a4b65b916bfb89c611149e8
SHA256

502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6
SHA512

1cd8b58ceaeab571bfafd38c9014712544c6ceb44de58cf84d4b20edffc9631bbe30cb59faf1f7ba1a54d2758653246213bc351b4c55dd57abe4d126311dd053
SSDEEP

768:O7UKiE1U4gbZt1gbRIbPqX2CsjUFSuoOiOGf/NjwkNfIxnQtMTsMGh:OAKiE1UBbP9cPsjOSPOiOY+2f8QtksMa

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe

description pid process

Token: SeDebugPrivilege 896 502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe

description	pid	process
Token: SeDebugPrivilege	896	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe

description	pid	process	target process
PID 896 wrote to memory of 1692	896	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe
PID 896 wrote to memory of 1692	896	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe
PID 896 wrote to memory of 1692	896	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe
PID 896 wrote to memory of 1692	896	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe
PID 896 wrote to memory of 932	896	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe
PID 896 wrote to memory of 932	896	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe
PID 896 wrote to memory of 932	896	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe
PID 896 wrote to memory of 932	896	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe	502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe

C:\Users\Admin\AppData\Local\Temp\502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe
C:\Users\Admin\AppData\Local\Temp\502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe
2⤵
PID:1692

C:\Users\Admin\AppData\Local\Temp\502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe
C:\Users\Admin\AppData\Local\Temp\502fdfabbe8c4ba719eef604ea508bbdd926a3831b4beb3e60de708669f5d2e6.exe
2⤵
PID:932

memory/896-54-0x0000000000C40000-0x0000000000C54000-memory.dmp

Filesize
80KB

Download