68256f23d81ca2ad5119360f6d0d3d39a6c3d9d6b9c63b8d3298883fd4456e69

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 08:43

Target

68256f23d81ca2ad5119360f6d0d3d39a6c3d9d6b9c63b8d3298883fd4456e69.exe
Size

96KB
MD5

7c80c1a15910e72cb67c8391e0a0cf10
SHA1

5435b9a9593fd672d2477c6ffeed1fb71910bf5c
SHA256

68256f23d81ca2ad5119360f6d0d3d39a6c3d9d6b9c63b8d3298883fd4456e69
SHA512

ae7d4a66f67aa642fe874ac3348b4e7c39c8d46f43be84bce60b43e29ce7ef43fd4342a3a1631f6a7868ca9b7201fe7e1d80e603db9cabd01e4790323b577a2e
SSDEEP

1536:i5UO4qGt6WXGzJ4MMrTkk1EuMBf+aX22Y7KtGJLkj5iXBFS7H2VQu+kJwTWbG:i5tHNorQk1ELBfvXVqeGJLg8XS7WVQuv

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	68256f23d81ca2ad5119360f6d0d3d39a6c3d9d6b9c63b8d3298883fd4456e69.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 984	2028	68256f23d81ca2ad5119360f6d0d3d39a6c3d9d6b9c63b8d3298883fd4456e69.exe	27
PID 2028 wrote to memory of 984	2028	68256f23d81ca2ad5119360f6d0d3d39a6c3d9d6b9c63b8d3298883fd4456e69.exe	27
PID 2028 wrote to memory of 984	2028	68256f23d81ca2ad5119360f6d0d3d39a6c3d9d6b9c63b8d3298883fd4456e69.exe	27
PID 2028 wrote to memory of 984	2028	68256f23d81ca2ad5119360f6d0d3d39a6c3d9d6b9c63b8d3298883fd4456e69.exe	27

C:\Users\Admin\AppData\Local\Temp\68256f23d81ca2ad5119360f6d0d3d39a6c3d9d6b9c63b8d3298883fd4456e69.exe
"C:\Users\Admin\AppData\Local\Temp\68256f23d81ca2ad5119360f6d0d3d39a6c3d9d6b9c63b8d3298883fd4456e69.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 524
  2⤵
  PID:984

memory/2028-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/2028-57-0x0000000074A00000-0x0000000074FAB000-memory.dmp

Filesize
5.7MB

Download
memory/2028-58-0x0000000074A00000-0x0000000074FAB000-memory.dmp

Filesize
5.7MB

Download