c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 00:07

Target

c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe
Size

3.3MB
MD5

4de5af729ad00141a4f4e9886c7a1602
SHA1

aa8012b6e0e65fa8466554ba93d0b89e2e288417
SHA256

c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b
SHA512

aa4de0fc92e7fb0b6696af143a94da5da843c3a7a83c20cba6355b567b77d9194cee40a63046823999f7b40fef23bd196acf610c6e9c349472680f25298fc023
SSDEEP

49152:IeQHPIv94444T4444CW8AWWaT4JBJmiJSrY7pFgbzjDO3DxPDboZ1:

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe

pid	process
4368	c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe
4368	c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe

description pid process

Token: SeDebugPrivilege 4368 c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe

description	pid	process
Token: SeDebugPrivilege	4368	c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe

description	pid	process	target process
PID 4368 wrote to memory of 652	4368	c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe	c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe
PID 4368 wrote to memory of 652	4368	c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe	c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe
PID 4368 wrote to memory of 652	4368	c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe	c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe

C:\Users\Admin\AppData\Local\Temp\c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe
"C:\Users\Admin\AppData\Local\Temp\c80f841abfbc29ea1f8f04101955ab2c2f895203f5439ab9e00c4c2c2f8ad31b.exe"
2⤵
PID:652

memory/652-133-0x0000000000000000-mapping.dmp

Download
memory/4368-132-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/4368-134-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download