872c707ce3001ea4923dd67aac7698d38b6d2f1db84a94b190c665f41425a7fe

Analysis

max time kernel
182s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 06:18

Target

872c707ce3001ea4923dd67aac7698d38b6d2f1db84a94b190c665f41425a7fe.exe
Size

53KB
MD5

6c0980a14abdd3686dbb9a11c3c601d1
SHA1

e175c563dd75b298c0a1ad1199d82c9281c2be7c
SHA256

872c707ce3001ea4923dd67aac7698d38b6d2f1db84a94b190c665f41425a7fe
SHA512

5bcff48d9c030b36f7f66b92302240d6ac3710974d91814c86e3df076520324900cdb96c80626700caba4d661e10fa9dc3b88ad1be9ff491bcb36503c5c66f6b
SSDEEP

768:TwftzGtlV2QGGkCnvNCHcR9hyxyQ1Rrn5R455jtOgjyImyfu8hl1uizbNeHbeQ4/:12bOgXR4fFGImyW8zJNibeQGxvJ8o

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4668	872c707ce3001ea4923dd67aac7698d38b6d2f1db84a94b190c665f41425a7fe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 3768	4668	872c707ce3001ea4923dd67aac7698d38b6d2f1db84a94b190c665f41425a7fe.exe	79
PID 4668 wrote to memory of 3768	4668	872c707ce3001ea4923dd67aac7698d38b6d2f1db84a94b190c665f41425a7fe.exe	79
PID 4668 wrote to memory of 3768	4668	872c707ce3001ea4923dd67aac7698d38b6d2f1db84a94b190c665f41425a7fe.exe	79

C:\Users\Admin\AppData\Local\Temp\872c707ce3001ea4923dd67aac7698d38b6d2f1db84a94b190c665f41425a7fe.exe
"C:\Users\Admin\AppData\Local\Temp\872c707ce3001ea4923dd67aac7698d38b6d2f1db84a94b190c665f41425a7fe.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:3768