021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2022 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
Size

32KB
MD5

408813bde311c47f12a2d0a173b1a270
SHA1

70144338004b9b49a9e0225cbd7bab0ded7988e0
SHA256

021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9
SHA512

6131ca1a08ea5befb48cd018b663baa221c04d819df32d47f384844e74ee35d7e4af7e064fa1e8fdb31cf37950f8d8d546aa140a757a80eaa1a4325e1602cea5
SSDEEP

768:fjSUT3BtUQsP6J89FT0obEVSZsrZ9SkR6HTZE2:LDTcQsP6J899tZsrLkTZ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 584	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	3
PID 4636 wrote to memory of 584	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	3
PID 4636 wrote to memory of 584	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	3
PID 4636 wrote to memory of 584	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	3
PID 4636 wrote to memory of 584	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	3
PID 4636 wrote to memory of 584	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	3
PID 4636 wrote to memory of 668	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	1
PID 4636 wrote to memory of 668	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	1
PID 4636 wrote to memory of 668	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	1
PID 4636 wrote to memory of 668	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	1
PID 4636 wrote to memory of 668	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	1
PID 4636 wrote to memory of 668	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	1
PID 4636 wrote to memory of 768	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	8
PID 4636 wrote to memory of 768	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	8
PID 4636 wrote to memory of 768	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	8
PID 4636 wrote to memory of 768	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	8
PID 4636 wrote to memory of 768	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	8
PID 4636 wrote to memory of 768	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	8
PID 4636 wrote to memory of 776	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	25
PID 4636 wrote to memory of 776	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	25
PID 4636 wrote to memory of 776	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	25
PID 4636 wrote to memory of 776	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	25
PID 4636 wrote to memory of 776	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	25
PID 4636 wrote to memory of 776	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	25
PID 4636 wrote to memory of 784	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	24
PID 4636 wrote to memory of 784	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	24
PID 4636 wrote to memory of 784	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	24
PID 4636 wrote to memory of 784	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	24
PID 4636 wrote to memory of 784	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	24
PID 4636 wrote to memory of 784	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	24
PID 4636 wrote to memory of 892	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	22
PID 4636 wrote to memory of 892	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	22
PID 4636 wrote to memory of 892	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	22
PID 4636 wrote to memory of 892	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	22
PID 4636 wrote to memory of 892	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	22
PID 4636 wrote to memory of 892	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	22
PID 4636 wrote to memory of 940	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	21
PID 4636 wrote to memory of 940	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	21
PID 4636 wrote to memory of 940	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	21
PID 4636 wrote to memory of 940	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	21
PID 4636 wrote to memory of 940	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	21
PID 4636 wrote to memory of 940	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	21
PID 4636 wrote to memory of 1008	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	9
PID 4636 wrote to memory of 1008	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	9
PID 4636 wrote to memory of 1008	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	9
PID 4636 wrote to memory of 1008	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	9
PID 4636 wrote to memory of 1008	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	9
PID 4636 wrote to memory of 1008	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	9
PID 4636 wrote to memory of 432	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	20
PID 4636 wrote to memory of 432	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	20
PID 4636 wrote to memory of 432	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	20
PID 4636 wrote to memory of 432	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	20
PID 4636 wrote to memory of 432	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	20
PID 4636 wrote to memory of 432	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	20
PID 4636 wrote to memory of 684	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	19
PID 4636 wrote to memory of 684	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	19
PID 4636 wrote to memory of 684	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	19
PID 4636 wrote to memory of 684	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	19
PID 4636 wrote to memory of 684	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	19
PID 4636 wrote to memory of 684	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	19
PID 4636 wrote to memory of 852	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	10
PID 4636 wrote to memory of 852	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	10
PID 4636 wrote to memory of 852	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	10
PID 4636 wrote to memory of 852	4636	021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe	10

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:584
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1008
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:776

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1144
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1320
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3456
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4820
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2056
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3544
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4068
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3744
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3552
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3352
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3244
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:5076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2040

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2444

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3884

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4572

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2424
- C:\Users\Admin\AppData\Local\Temp\021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe
  "C:\Users\Admin\AppData\Local\Temp\021f602e2260bf4b40248b8f1bebf7f4038c8adaa6d17fb9a2c1ca42ce67f4e9.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4636-132-0x0000000001000000-0x000000000100C000-memory.dmp

Filesize
48KB

Download
memory/4636-133-0x0000000001000000-0x000000000100C000-memory.dmp

Filesize
48KB

Download