52624fc18a4b25b5443e053f424e804f77b3beae0faf37d5c2cb071295b87edf

Analysis

max time kernel
22s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 08:50

Target

52624fc18a4b25b5443e053f424e804f77b3beae0faf37d5c2cb071295b87edf.exe
Size

564KB
MD5

5965427f53a93f128de300991e8c2568
SHA1

2baa75204149baebe4c215defe4e44192049f381
SHA256

52624fc18a4b25b5443e053f424e804f77b3beae0faf37d5c2cb071295b87edf
SHA512

ee9a6a446bd888927d0b88d4862de5562fc9ddadec95c897af161c1ae91eee0181c5594ee7fcc122eb1cc5fae6089b194f9e48925fb613094ec2c6ee7e08e02a
SSDEEP

12288:3IKsRt/D/X9kxj/mWJMNaLkH6oOxCjCx4NCyBEYGK0zygVl:4Km7/XmxyWJMQLG0NCEbKvUl

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2044	52624fc18a4b25b5443e053f424e804f77b3beae0faf37d5c2cb071295b87edf.exe
Token: SeSecurityPrivilege	2044	52624fc18a4b25b5443e053f424e804f77b3beae0faf37d5c2cb071295b87edf.exe
Token: SeSecurityPrivilege	2044	52624fc18a4b25b5443e053f424e804f77b3beae0faf37d5c2cb071295b87edf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2000	2044	52624fc18a4b25b5443e053f424e804f77b3beae0faf37d5c2cb071295b87edf.exe	27
PID 2044 wrote to memory of 2000	2044	52624fc18a4b25b5443e053f424e804f77b3beae0faf37d5c2cb071295b87edf.exe	27
PID 2044 wrote to memory of 2000	2044	52624fc18a4b25b5443e053f424e804f77b3beae0faf37d5c2cb071295b87edf.exe	27
PID 2044 wrote to memory of 2000	2044	52624fc18a4b25b5443e053f424e804f77b3beae0faf37d5c2cb071295b87edf.exe	27

C:\Users\Admin\AppData\Local\Temp\52624fc18a4b25b5443e053f424e804f77b3beae0faf37d5c2cb071295b87edf.exe
"C:\Users\Admin\AppData\Local\Temp\52624fc18a4b25b5443e053f424e804f77b3beae0faf37d5c2cb071295b87edf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 576
  2⤵
  PID:2000

memory/2044-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/2044-55-0x0000000074EB0000-0x000000007545B000-memory.dmp

Filesize
5.7MB

Download
memory/2044-58-0x0000000074EB0000-0x000000007545B000-memory.dmp

Filesize
5.7MB

Download