67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d

Analysis

max time kernel
186s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:06

Target

67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe
Size

128KB
MD5

8be26cd4d933ba2b399fa0bf18aa328c
SHA1

404a1ab894b3bced93f1943f777616e1d4c2eb2d
SHA256

67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d
SHA512

68e1632b2f4cd0616bc456c549788a289166ca9c39c886b01dd9c8ede7218e98ecc6cf06a609a8127d61091dbccfe820415d85da5a6f0e6427bca4f36b369c51
SSDEEP

3072:BhoJDkVOMBtgvDaiu22pBQOdNFElk9hRzpWJeInz04Kti+E+:BelkU7DacKBP/CCHRzpWJe20gA

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe

description pid process

Token: SeDebugPrivilege 4256 67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe

description	pid	process
Token: SeDebugPrivilege	4256	67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe

description	pid	process	target process
PID 4256 wrote to memory of 4580	4256	67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe	67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe
PID 4256 wrote to memory of 4580	4256	67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe	67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe

C:\Users\Admin\AppData\Local\Temp\67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe
"C:\Users\Admin\AppData\Local\Temp\67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe
  C:\Users\Admin\AppData\Local\Temp\67722191bce973e2d281ea42be61006f0f47f07bb97d847d916f7e339cf1e98d.exe
  2⤵
  PID:4580

memory/4256-132-0x00007FFA94930000-0x00007FFA95366000-memory.dmp

Filesize
10.2MB

Download