fed7f4b45f50ebd12959648cd319d4e4141142927a8386460e093d5bab407e9d

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 17:57

Target

fed7f4b45f50ebd12959648cd319d4e4141142927a8386460e093d5bab407e9d.exe
Size

572KB
MD5

835da99011115a5df67a6be18f6b5bd6
SHA1

370250cbe8ceefb0a1c00dbc7a5c0c63dfd1ea8b
SHA256

fed7f4b45f50ebd12959648cd319d4e4141142927a8386460e093d5bab407e9d
SHA512

c398d38ee8799f33193bc0e96d7490ea3962ec59f4f12f690827c22a9b8555b1fd20ba0824a162913b09ac891c95e46d6b4ef07df40512715206903594baf44d
SSDEEP

12288:ISOiDok75gCheKzebUHDJYhTOHsK/TZnejT3vCa5Y6bC4TqmxEEI:Ii6gewHJMKLkfCaubN22

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1912	900	fed7f4b45f50ebd12959648cd319d4e4141142927a8386460e093d5bab407e9d.exe	27
PID 900 wrote to memory of 1912	900	fed7f4b45f50ebd12959648cd319d4e4141142927a8386460e093d5bab407e9d.exe	27
PID 900 wrote to memory of 1912	900	fed7f4b45f50ebd12959648cd319d4e4141142927a8386460e093d5bab407e9d.exe	27
PID 900 wrote to memory of 1912	900	fed7f4b45f50ebd12959648cd319d4e4141142927a8386460e093d5bab407e9d.exe	27

C:\Users\Admin\AppData\Local\Temp\fed7f4b45f50ebd12959648cd319d4e4141142927a8386460e093d5bab407e9d.exe
"C:\Users\Admin\AppData\Local\Temp\fed7f4b45f50ebd12959648cd319d4e4141142927a8386460e093d5bab407e9d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 576
  2⤵
  PID:1912

memory/900-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/900-55-0x0000000074460000-0x0000000074A0B000-memory.dmp

Filesize
5.7MB

Download
memory/900-58-0x0000000074460000-0x0000000074A0B000-memory.dmp

Filesize
5.7MB

Download