98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24

Analysis

max time kernel
112s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 00:46

Target

98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe
Size

56KB
MD5

3972d3c47913bc3fb3bcd82cc45e2be7
SHA1

ea6424eab14d0a38cb71184a9e10449c5ed205e2
SHA256

98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24
SHA512

95084d043559373cb71f8bf24b410bcc73bf6944b88fb85111c1274327b40035f760fefd063d73286b7c1cfbf33fa0b1fe57e9af3d8a7e59788e8b071305d75e
SSDEEP

1536:Z2SIENFMRsqhE3mCcIOMb0FoRxLZLPVb5Ul:c8wsqGIo3pNb5q

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 3608	1316	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	82
PID 1316 wrote to memory of 3608	1316	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	82
PID 1316 wrote to memory of 3608	1316	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	82
PID 1316 wrote to memory of 4264	1316	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	83
PID 1316 wrote to memory of 4264	1316	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	83
PID 1316 wrote to memory of 4264	1316	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	83

C:\Users\Admin\AppData\Local\Temp\98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe
"C:\Users\Admin\AppData\Local\Temp\98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Users\Admin\AppData\Local\Temp\98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe
  C:\Users\Admin\AppData\Local\Temp\98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe
  2⤵
  PID:3608
- C:\Users\Admin\AppData\Local\Temp\98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe
  C:\Users\Admin\AppData\Local\Temp\98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe
  2⤵
  PID:4264

memory/1316-133-0x0000000074F10000-0x00000000754C1000-memory.dmp

Filesize
5.7MB

Download