bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 14:19

Target

bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe
Size

307KB
MD5

36bfcf1de6ab97d9124036e38bfd4221
SHA1

985bb45e0e768a1f9d505580a27cd0a2e29e07c8
SHA256

bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694
SHA512

63c7631adf5813a32c62f9154a47ddbacec6cb75751c09c2e15f9f6ff315f6952763ce7965f3fd12569c3bcd80f9c6c4c6f24913c48c210ee680c7a44de684a9
SSDEEP

6144:rYd37RspU4qFr059JVp0grxFoY4KGv6xrcOlFdvLg0pFpSFhFWTbb:rY4TMr0lVpxr3oY4KEeYOlFdvLM/FAb

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1956	1612	bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe	26
PID 1612 wrote to memory of 1956	1612	bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe	26
PID 1612 wrote to memory of 1956	1612	bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe	26
PID 1612 wrote to memory of 1956	1612	bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe	26
PID 1612 wrote to memory of 1948	1612	bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe	27
PID 1612 wrote to memory of 1948	1612	bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe	27
PID 1612 wrote to memory of 1948	1612	bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe	27
PID 1612 wrote to memory of 1948	1612	bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe	27

C:\Users\Admin\AppData\Local\Temp\bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe
"C:\Users\Admin\AppData\Local\Temp\bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe
  bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe
  2⤵
  PID:1956
- C:\Users\Admin\AppData\Local\Temp\bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe
  bbaedbee7b6bd515adcd8e7f6bf585d8e5fc9fb7369de21158efb27ca293f694.exe
  2⤵
  PID:1948

memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1612-55-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download