e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2

Analysis

max time kernel
176s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 13:32

Target

e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2.exe
Size

110KB
MD5

a7af90f5da509415d3e03b2636628529
SHA1

ab5f9294f77211bce8c0860964ef0408eeccf9f5
SHA256

e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2
SHA512

02e9d40d28bef9cf976342cdc19bc0b5081bf87ab2fc57b792201f3a57a6595f38f2e4fda31610687e5f621dc446dc14b92fee6c7c5eb8aff878cdc31fb90845
SSDEEP

3072:ch6Jsu7EQ7qOIx4J2vNbGfvGnd3gW5ZM4/us:+0V7EQ7GNdndPZMTs

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3076	e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2.exe
Token: SeDebugPrivilege	3076	e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 4948	3076	e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2.exe	84
PID 3076 wrote to memory of 4948	3076	e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2.exe	84
PID 3076 wrote to memory of 4948	3076	e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2.exe	84

C:\Users\Admin\AppData\Local\Temp\e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2.exe
"C:\Users\Admin\AppData\Local\Temp\e3c799397c7e076d9e1d69ed46a093fb6bf46f08146f088a022a6a2d5a4abce2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4948

memory/3076-132-0x0000000000400000-0x0000000000437D74-memory.dmp

Filesize
223KB

Download
memory/3076-134-0x0000000000400000-0x0000000000437D74-memory.dmp

Filesize
223KB

Download