Analysis
-
max time kernel
76s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
06/12/2022, 22:52
General
-
Target
9d2034342fe7802fa45a895cf6906c69cc5e2e56278e3dcb16ffbfbf26eb876b.exe
-
Size
1.8MB
-
MD5
c5db03d69bb592c3ed3c9376da6ac86c
-
SHA1
935181f9576d6ee66cfb684e0ac718da185175fe
-
SHA256
9d2034342fe7802fa45a895cf6906c69cc5e2e56278e3dcb16ffbfbf26eb876b
-
SHA512
cf07dc85fcefcb318eed9ed5ae30a9def4743f8b284ee2cde6528ddbe8b889c2f271f9b4c23adf6079f83a0a7cfde7c437e25ace9b34b630ceba52f3c8e69437
-
SSDEEP
24576:4lyPe+kN97+N87OV7xfYrWKLbb6DBYosmT9t9lXk0zMK7J6Q:45LXS1BY/b6Dam/bRL
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9d2034342fe7802fa45a895cf6906c69cc5e2e56278e3dcb16ffbfbf26eb876b.exe"C:\Users\Admin\AppData\Local\Temp\9d2034342fe7802fa45a895cf6906c69cc5e2e56278e3dcb16ffbfbf26eb876b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory