65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e

Analysis

max time kernel
339s
max time network
414s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 02:16

Target

65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe
Size

423KB
MD5

d29da3bca8e7dbf2a87020588da801db
SHA1

9b81046cd513b614e8403378c55192b9bb0329b2
SHA256

65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e
SHA512

3ed179ecf3c8dd90a52b99d8c9c8db2af52a3c760f0a0f62370665d3a1a5d869f796260e6b26721ed3a298a0a8e54bf7289bcc7ff75cc46725dbfe5950e0d407
SSDEEP

12288:XnSWRCROiQ6HqJWRCROi9Pzu0ds6monDCx:XBCBtqwCBpDZt

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe

pid	process
4680	65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe
4680	65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe

description pid process

Token: SeDebugPrivilege 4680 65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe

description	pid	process
Token: SeDebugPrivilege	4680	65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe

description	pid	process	target process
PID 4680 wrote to memory of 2992	4680	65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe	65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe
PID 4680 wrote to memory of 2992	4680	65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe	65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe
PID 4680 wrote to memory of 2992	4680	65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe	65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe

C:\Users\Admin\AppData\Local\Temp\65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe
"C:\Users\Admin\AppData\Local\Temp\65aefbaae23c85b6c6950f5303082019ffb43f20ea775e065633cd058eca1f8e.exe"
2⤵
PID:2992

memory/2992-133-0x0000000000000000-mapping.dmp

Download
memory/4680-132-0x0000000075240000-0x00000000757F1000-memory.dmp

Filesize
5.7MB

Download
memory/4680-134-0x0000000075240000-0x00000000757F1000-memory.dmp

Filesize
5.7MB

Download
memory/4680-135-0x0000000075240000-0x00000000757F1000-memory.dmp

Filesize
5.7MB

Download