5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e

Analysis

max time kernel
38s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 13:05

Target

5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e.exe
Size

256KB
MD5

27c09ea9c45b680d3e70e6164bac54cb
SHA1

eb89b4ff1297c7487f2446e3653946fa27366468
SHA256

5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e
SHA512

458457a1889e85cacf543eb8fbd34c3e7b46fb7a80c4362ee2889ff74300071331df93f64d4edb04e66b7a4c274fb6c376fd26c24ee7648dc03780312d813eb2
SSDEEP

3072:9b1+HiRIBiPcgmCJXck+GLEM14qZFFjgh0fQ2OrrQVEVUM1IjnZcXewEfazr87aI:/+wlMU9TGMVEVqOufaX8jDqTAvbX1

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e.exe

pid	process
4408	5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e.exe
4408	5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e.exe

description pid process

Token: SeDebugPrivilege 4408 5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e.exe

description	pid	process
Token: SeDebugPrivilege	4408	5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e.exe

description	pid	process	target process
PID 4408 wrote to memory of 2236	4408	5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e.exe	cmd.exe
PID 4408 wrote to memory of 2236	4408	5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e.exe	cmd.exe
PID 4408 wrote to memory of 2236	4408	5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e.exe	cmd.exe
PID 4408 wrote to memory of 2348	4408	5f828582d372f3c1ab39031aaf7a655c20052f9701089c32ce981a8b8559502e.exe	Explorer.EXE

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3513~1.BAT"
3⤵
PID:2236

memory/2236-134-0x0000000000000000-mapping.dmp

Download
memory/2348-135-0x00007FFD5C5D0000-0x00007FFD5C5E0000-memory.dmp

Filesize
64KB

Download
memory/4408-132-0x0000000001000000-0x000000000100D000-memory.dmp

Filesize
52KB

Download
memory/4408-133-0x0000000000410000-0x0000000000453000-memory.dmp

Filesize
268KB

Download