e8c4a2c27c7ad68d07feea62f0d0507370238aa30aba32b95e63b968d3cbec42

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 05:56

Target

e8c4a2c27c7ad68d07feea62f0d0507370238aa30aba32b95e63b968d3cbec42.exe
Size

136KB
MD5

57abf5c7bae842cd0c83fb51b3b35760
SHA1

7124c899b4748c2c30ef4eb0b33135f85f450434
SHA256

e8c4a2c27c7ad68d07feea62f0d0507370238aa30aba32b95e63b968d3cbec42
SHA512

efb5d88b89cc74d4e0cf75d768df048eb9e685888bcbb00f40c8b2256038ec8c618ce9e3f35399ca30066669c39710cd394a1945ccf62368e091d036f4ca9f88
SSDEEP

1536:6HgsXXQQpngt0uILKA3r+LVN+TbQovn8AAzp4oeXHXA9SzcFDOgiXbqruuNLA:wtgyur4+xN+hn+zp+3A9hFDZO

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	964	e8c4a2c27c7ad68d07feea62f0d0507370238aa30aba32b95e63b968d3cbec42.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 2740	964	e8c4a2c27c7ad68d07feea62f0d0507370238aa30aba32b95e63b968d3cbec42.exe	81
PID 964 wrote to memory of 2740	964	e8c4a2c27c7ad68d07feea62f0d0507370238aa30aba32b95e63b968d3cbec42.exe	81
PID 964 wrote to memory of 2740	964	e8c4a2c27c7ad68d07feea62f0d0507370238aa30aba32b95e63b968d3cbec42.exe	81

C:\Users\Admin\AppData\Local\Temp\e8c4a2c27c7ad68d07feea62f0d0507370238aa30aba32b95e63b968d3cbec42.exe
"C:\Users\Admin\AppData\Local\Temp\e8c4a2c27c7ad68d07feea62f0d0507370238aa30aba32b95e63b968d3cbec42.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964
- C:\Users\Admin\AppData\Local\Temp\e8c4a2c27c7ad68d07feea62f0d0507370238aa30aba32b95e63b968d3cbec42.exe
  C:\Users\Admin\AppData\Local\Temp\e8c4a2c27c7ad68d07feea62f0d0507370238aa30aba32b95e63b968d3cbec42.exe
  2⤵
  PID:2740

memory/964-132-0x0000000074E30000-0x00000000753E1000-memory.dmp

Filesize
5.7MB

Download
memory/964-134-0x0000000074E30000-0x00000000753E1000-memory.dmp

Filesize
5.7MB

Download
memory/2740-133-0x0000000000000000-mapping.dmp

Download