67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d

Analysis

max time kernel
50s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:06

Target

67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe
Size

128KB
MD5

8be26cd4d933ba2b399fa0bf18aa328c
SHA1

404a1ab894b3bced93f1943f777616e1d4c2eb2d
SHA256

67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d
SHA512

68e1632b2f4cd0616bc456c549788a289166ca9c39c886b01dd9c8ede7218e98ecc6cf06a609a8127d61091dbccfe820415d85da5a6f0e6427bca4f36b369c51
SSDEEP

3072:BhoJDkVOMBtgvDaiu22pBQOdNFElk9hRzpWJeInz04Kti+E+:BelkU7DacKBP/CCHRzpWJe20gA

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe

description pid process

Token: SeDebugPrivilege 1792 67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe

description	pid	process
Token: SeDebugPrivilege	1792	67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe

description	pid	process	target process
PID 1792 wrote to memory of 944	1792	67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe	67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe
PID 1792 wrote to memory of 944	1792	67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe	67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe
PID 1792 wrote to memory of 944	1792	67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe	67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe

C:\Users\Admin\AppData\Local\Temp\67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe
"C:\Users\Admin\AppData\Local\Temp\67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe
  C:\Users\Admin\AppData\Local\Temp\67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe
  2⤵
  PID:944

memory/1792-54-0x000007FEF3650000-0x000007FEF4073000-memory.dmp

Filesize
10.1MB

Download
memory/1792-55-0x000007FEF25B0000-0x000007FEF3646000-memory.dmp

Filesize
16.6MB

Download