625b1d03e46f7f850dc9be6aaa27a8d07770049102ecace06cb5326412022265

Analysis

max time kernel
197s
max time network
244s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 18:56

Target

625b1d03e46f7f850dc9be6aaa27a8d07770049102ecace06cb5326412022265.exe
Size

541KB
MD5

61a8e83691cb299b433e8d64d67b9a40
SHA1

0141851caeba0713360c2749a45fff89589c3a96
SHA256

625b1d03e46f7f850dc9be6aaa27a8d07770049102ecace06cb5326412022265
SHA512

b9a449049a3f5c325eec18ff22b4a67825af6e2c593be225225169ee09d6c3985e5e2eca79a145cf8d841d093c943f107b7823f69c653e377124d7ffa819cb5d
SSDEEP

768:/Z1C/HjNmImp8k9RV4+RiHdxOnW5MedsruJDWaS77BKbwexZw32SLg0innjhyVT5:ax/mT9j2WW5MeGD7BKb7+it2N

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	625b1d03e46f7f850dc9be6aaa27a8d07770049102ecace06cb5326412022265.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 752	4272	625b1d03e46f7f850dc9be6aaa27a8d07770049102ecace06cb5326412022265.exe	83
PID 4272 wrote to memory of 752	4272	625b1d03e46f7f850dc9be6aaa27a8d07770049102ecace06cb5326412022265.exe	83
PID 4272 wrote to memory of 752	4272	625b1d03e46f7f850dc9be6aaa27a8d07770049102ecace06cb5326412022265.exe	83

C:\Users\Admin\AppData\Local\Temp\625b1d03e46f7f850dc9be6aaa27a8d07770049102ecace06cb5326412022265.exe
"C:\Users\Admin\AppData\Local\Temp\625b1d03e46f7f850dc9be6aaa27a8d07770049102ecace06cb5326412022265.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Users\Admin\AppData\Local\Temp\625b1d03e46f7f850dc9be6aaa27a8d07770049102ecace06cb5326412022265.exe
  C:\Users\Admin\AppData\Local\Temp\625b1d03e46f7f850dc9be6aaa27a8d07770049102ecace06cb5326412022265.exe
  2⤵
  PID:752

memory/4272-132-0x00000000003A0000-0x000000000042E000-memory.dmp

Filesize
568KB

Download
memory/4272-133-0x0000000005490000-0x0000000005A34000-memory.dmp

Filesize
5.6MB

Download
memory/4272-134-0x0000000004DD0000-0x0000000004E62000-memory.dmp

Filesize
584KB

Download
memory/4272-135-0x0000000004E70000-0x0000000004E7A000-memory.dmp

Filesize
40KB

Download
memory/4272-136-0x0000000007270000-0x000000000730C000-memory.dmp

Filesize
624KB

Download