dae487db55808c01296ebf65c09a1c32e4eab45151704434b14764c2dccdd590

Analysis

max time kernel
29s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 22:11

Target

dae487db55808c01296ebf65c09a1c32e4eab45151704434b14764c2dccdd590.exe
Size

93KB
MD5

73017018f06f8d220ba35e2d28c30a1d
SHA1

a645fcb19ea14d7ba355c3103fa5729c255efeba
SHA256

dae487db55808c01296ebf65c09a1c32e4eab45151704434b14764c2dccdd590
SHA512

fb11df2746bdfcafb6dfeaee5ccea68a22e55fcdbd8f6bd0f8cffa2f8ca6b353e7f54d9391e3f758802905d8f9c51eb69b6961c129769f5fc5519cce1690b22e
SSDEEP

1536:+HxCaqYLXJOfEbvdTvqGORq0H/waHXxoqNFcMeYxoPRr:+Hx8YL02HamwFDoP

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3060	lsass.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe	dae487db55808c01296ebf65c09a1c32e4eab45151704434b14764c2dccdd590.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3060	lsass.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	dae487db55808c01296ebf65c09a1c32e4eab45151704434b14764c2dccdd590.exe
Token: SeDebugPrivilege	3060	lsass.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3060	1376	dae487db55808c01296ebf65c09a1c32e4eab45151704434b14764c2dccdd590.exe	81
PID 1376 wrote to memory of 3060	1376	dae487db55808c01296ebf65c09a1c32e4eab45151704434b14764c2dccdd590.exe	81
PID 1376 wrote to memory of 3060	1376	dae487db55808c01296ebf65c09a1c32e4eab45151704434b14764c2dccdd590.exe	81
PID 3060 wrote to memory of 644	3060	lsass.exe	82
PID 3060 wrote to memory of 644	3060	lsass.exe	82

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe

Filesize
93KB

MD5
73017018f06f8d220ba35e2d28c30a1d

SHA1
a645fcb19ea14d7ba355c3103fa5729c255efeba

SHA256
dae487db55808c01296ebf65c09a1c32e4eab45151704434b14764c2dccdd590

SHA512
fb11df2746bdfcafb6dfeaee5ccea68a22e55fcdbd8f6bd0f8cffa2f8ca6b353e7f54d9391e3f758802905d8f9c51eb69b6961c129769f5fc5519cce1690b22e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe

Filesize
93KB

MD5
73017018f06f8d220ba35e2d28c30a1d

SHA1
a645fcb19ea14d7ba355c3103fa5729c255efeba

SHA256
dae487db55808c01296ebf65c09a1c32e4eab45151704434b14764c2dccdd590

SHA512
fb11df2746bdfcafb6dfeaee5ccea68a22e55fcdbd8f6bd0f8cffa2f8ca6b353e7f54d9391e3f758802905d8f9c51eb69b6961c129769f5fc5519cce1690b22e

Download Submit
memory/644-136-0x0000000000000000-mapping.dmp

Download
memory/644-138-0x0000000000300000-0x0000000000327000-memory.dmp

Filesize
156KB

Download
memory/1376-132-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3060-133-0x0000000000000000-mapping.dmp

Download
memory/3060-137-0x00000000005D0000-0x00000000005F7000-memory.dmp

Filesize
156KB

Download