a0e3395f389e3507dae0527fbaed1debb15160c5b3fd7564a29e22dc33f6221d

Analysis

max time kernel
112s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 15:32

Target

a0e3395f389e3507dae0527fbaed1debb15160c5b3fd7564a29e22dc33f6221d.exe
Size

14KB
MD5

078d661f3d0c8c5ee7e81bb6f2589c53
SHA1

4e736fe50fa132eaccd03f6c334568142bc12fc7
SHA256

a0e3395f389e3507dae0527fbaed1debb15160c5b3fd7564a29e22dc33f6221d
SHA512

4ce07b191d3c22bb44bc28cf0ff9b631ae52a6d06f5aae7cb8ccfb1b1f8f15753c2c92539e6a002e9a717bc1be03a124bda41d34a850d3a4d5d707b0664510f5
SSDEEP

384:IIzzSNmZcgnabKEPA4j1uQLHrgW2LkF/oJ4lK0P6N261AORS6d:IoGNmZhYKij1uygW2oF/hI0P6Q8T7d

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
4172	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4172	1616	a0e3395f389e3507dae0527fbaed1debb15160c5b3fd7564a29e22dc33f6221d.exe	80
PID 1616 wrote to memory of 4172	1616	a0e3395f389e3507dae0527fbaed1debb15160c5b3fd7564a29e22dc33f6221d.exe	80
PID 1616 wrote to memory of 4172	1616	a0e3395f389e3507dae0527fbaed1debb15160c5b3fd7564a29e22dc33f6221d.exe	80

C:\Users\Admin\AppData\Local\Temp\a0e3395f389e3507dae0527fbaed1debb15160c5b3fd7564a29e22dc33f6221d.exe
"C:\Users\Admin\AppData\Local\Temp\a0e3395f389e3507dae0527fbaed1debb15160c5b3fd7564a29e22dc33f6221d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im KSafeTray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4172

memory/1616-133-0x0000000000400000-0x000000000041D1F0-memory.dmp

Filesize
116KB

Download
memory/1616-134-0x0000000000400000-0x000000000041D1F0-memory.dmp

Filesize
116KB

Download