cd348d71f661068d9dd46398c96cca90c02f312bab2b22dec01d66f5284f8906

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 08:05

Target

cd348d71f661068d9dd46398c96cca90c02f312bab2b22dec01d66f5284f8906.exe
Size

348KB
MD5

80ef8d50f98a0c3e38d2ee95e5b80865
SHA1

7a2af904ed0c5ecad27dde8e75894a387684f4cd
SHA256

cd348d71f661068d9dd46398c96cca90c02f312bab2b22dec01d66f5284f8906
SHA512

57e7fa916d8514890f1ebcea29119b88d5041bde752a1a8f3c218201c501115c80e6ab768bbc06e4d946597add9fcf7648b9066ae08f1d50abee370b7572a4e6
SSDEEP

6144:CX3eEJaE4phmat0eDZMKO9HpbWg6uB/iZJN5d99bzdi6s3X+O9RS:43eG7khmat0eDZMKOHscsbnbUztS

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1728	cd348d71f661068d9dd46398c96cca90c02f312bab2b22dec01d66f5284f8906.exe
Token: SeSecurityPrivilege	1728	cd348d71f661068d9dd46398c96cca90c02f312bab2b22dec01d66f5284f8906.exe
Token: SeSecurityPrivilege	1728	cd348d71f661068d9dd46398c96cca90c02f312bab2b22dec01d66f5284f8906.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1484	1728	cd348d71f661068d9dd46398c96cca90c02f312bab2b22dec01d66f5284f8906.exe	28
PID 1728 wrote to memory of 1484	1728	cd348d71f661068d9dd46398c96cca90c02f312bab2b22dec01d66f5284f8906.exe	28
PID 1728 wrote to memory of 1484	1728	cd348d71f661068d9dd46398c96cca90c02f312bab2b22dec01d66f5284f8906.exe	28
PID 1728 wrote to memory of 1484	1728	cd348d71f661068d9dd46398c96cca90c02f312bab2b22dec01d66f5284f8906.exe	28

C:\Users\Admin\AppData\Local\Temp\cd348d71f661068d9dd46398c96cca90c02f312bab2b22dec01d66f5284f8906.exe
"C:\Users\Admin\AppData\Local\Temp\cd348d71f661068d9dd46398c96cca90c02f312bab2b22dec01d66f5284f8906.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 576
  2⤵
  PID:1484

memory/1728-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1728-57-0x0000000074140000-0x00000000746EB000-memory.dmp

Filesize
5.7MB

Download
memory/1728-58-0x0000000074140000-0x00000000746EB000-memory.dmp

Filesize
5.7MB

Download