a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef

Analysis

max time kernel
34s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 12:41

Target

a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe
Size

184KB
MD5

6d97276e6144da0b850904d915891200
SHA1

7b5f6cb90e68259d86b40e3ed942dc18f5fe2cc7
SHA256

a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef
SHA512

a167d0b8e9c61d2c4d9d3840892d558152caa6ff12cdbef15c5d8b1b16ed65000bfea1d0237ac887ef8035adfca9fce22d9e418c7d6bef8486523dd04c83b5d8
SSDEEP

3072:4P/64wC0/OcdLa+1bpTydsuPruWKHZa782g8welS:4nr302+LNpWdVTuW0Ivg8wQS

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe

description	pid	process
Token: SeDebugPrivilege	2760	a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe
Token: 33	2760	a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe
Token: SeIncBasePriorityPrivilege	2760	a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe

description	pid	process	target process
PID 2760 wrote to memory of 2840	2760	a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe	a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe
PID 2760 wrote to memory of 2840	2760	a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe	a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe
PID 2760 wrote to memory of 2840	2760	a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe	a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe

C:\Users\Admin\AppData\Local\Temp\a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe
"C:\Users\Admin\AppData\Local\Temp\a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe
  C:\Users\Admin\AppData\Local\Temp\a14aa43eb0b12222e7c53006ef394b1869bcc2183f382d8703a24de201ee6aef.exe
  2⤵
  PID:2840

memory/2760-132-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/2760-134-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/2840-133-0x0000000000000000-mapping.dmp

Download