0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f

Analysis

max time kernel
33s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 15:21

Target

0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe
Size

290KB
MD5

6a890900f264d91b22368ece3b4c2ec0
SHA1

c7f9facce25fde3e168068beb8e2e0d002a1fc80
SHA256

0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f
SHA512

1addbf55230369de0e8fe5e572595b3b20248bcce4c824e1ab3a8deeb73dfa678034cfbee953cee79b439a7bde4b678df0c947b60a7fde9e6f6fcf89c16ba87e
SSDEEP

3072:nMY0O8BEMxRURH1S6Ll65S69q/N6LcaubmmeeleYugci1ze7AdkddcdrFWJw7rr/:MY03M1S6kL1OEG2xFjX9M

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe

description pid process

Token: SeDebugPrivilege 976 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe

description	pid	process
Token: SeDebugPrivilege	976	0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe

description	pid	process	target process
PID 976 wrote to memory of 1972	976	0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe	0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe
PID 976 wrote to memory of 1972	976	0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe	0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe
PID 976 wrote to memory of 1972	976	0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe	0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe
PID 976 wrote to memory of 1972	976	0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe	0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe

C:\Users\Admin\AppData\Local\Temp\0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe
C:\Users\Admin\AppData\Local\Temp\0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe
2⤵
PID:1972

memory/976-54-0x0000000000260000-0x00000000002AE000-memory.dmp

Filesize
312KB

Download
memory/976-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/976-56-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/976-57-0x00000000049B5000-0x00000000049C6000-memory.dmp

Filesize
68KB

Download