bf48feef74617982c66f596d7808c9acc17d45e4852d6db0f621a3c0fc9c6a84

Analysis

max time kernel
176s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 17:33

Target

bf48feef74617982c66f596d7808c9acc17d45e4852d6db0f621a3c0fc9c6a84.exe
Size

127KB
MD5

0a39f75776f0b712048247ba627b858c
SHA1

16ade046b250bac5c315c127d45d8a45004c62cc
SHA256

bf48feef74617982c66f596d7808c9acc17d45e4852d6db0f621a3c0fc9c6a84
SHA512

8d9531c1e7a4619f58f7e2898322df31d73c295ecb3c84c25ac8eb51bfdaee03863e3fe658dd3fbb9fc49dbe8bef563fd4e18edda2105f5b8fa5260183bec5f5
SSDEEP

768:XEZZF1B6AThjtj+Pd0x8iTbGkExP1DV0SuBB2DZ1vzUB2pD8yUelrS/wPIxA/4NQ:UZZF1Bbtj+ex1TbGRZSBBEzzEhXU3Lp

Score

1^/10

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4848 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 4848 taskkill.exe

pid	process
4848	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	4848	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bf48feef74617982c66f596d7808c9acc17d45e4852d6db0f621a3c0fc9c6a84.exe

description	pid	process	target process
PID 4844 wrote to memory of 4848	4844	bf48feef74617982c66f596d7808c9acc17d45e4852d6db0f621a3c0fc9c6a84.exe	taskkill.exe
PID 4844 wrote to memory of 4848	4844	bf48feef74617982c66f596d7808c9acc17d45e4852d6db0f621a3c0fc9c6a84.exe	taskkill.exe
PID 4844 wrote to memory of 4848	4844	bf48feef74617982c66f596d7808c9acc17d45e4852d6db0f621a3c0fc9c6a84.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\bf48feef74617982c66f596d7808c9acc17d45e4852d6db0f621a3c0fc9c6a84.exe
"C:\Users\Admin\AppData\Local\Temp\bf48feef74617982c66f596d7808c9acc17d45e4852d6db0f621a3c0fc9c6a84.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4844

memory/4844-133-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4848-132-0x0000000000000000-mapping.dmp

Download