ae035241f6d3d006e9cb2eb0d3177ce90527dd138abf36d95c3f98184399a6d5

Analysis

max time kernel
20s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 11:48

Target

ae035241f6d3d006e9cb2eb0d3177ce90527dd138abf36d95c3f98184399a6d5.exe
Size

124KB
MD5

f781c2a59d32368cd865c3b9192a3fe6
SHA1

62e042be4e50b0f5c90809c8b6af3c860d7fe591
SHA256

ae035241f6d3d006e9cb2eb0d3177ce90527dd138abf36d95c3f98184399a6d5
SHA512

97968a8eeac722cfb8253ae1ccc665aed5c65e273068ccb703717016ba1f51096e7d47c8a83b19955ef4b293100901e6a75d65d3f5e17ec5eb81c5642bed1232
SSDEEP

768:sfZpVzjUg8FLtj+bVd0h8FxlBGkVxPGN0nyvDQ:sfZpVzz8htj+bEhOlBGBuCDQ

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
1640	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1640	960	ae035241f6d3d006e9cb2eb0d3177ce90527dd138abf36d95c3f98184399a6d5.exe	28
PID 960 wrote to memory of 1640	960	ae035241f6d3d006e9cb2eb0d3177ce90527dd138abf36d95c3f98184399a6d5.exe	28
PID 960 wrote to memory of 1640	960	ae035241f6d3d006e9cb2eb0d3177ce90527dd138abf36d95c3f98184399a6d5.exe	28
PID 960 wrote to memory of 1640	960	ae035241f6d3d006e9cb2eb0d3177ce90527dd138abf36d95c3f98184399a6d5.exe	28

C:\Users\Admin\AppData\Local\Temp\ae035241f6d3d006e9cb2eb0d3177ce90527dd138abf36d95c3f98184399a6d5.exe
"C:\Users\Admin\AppData\Local\Temp\ae035241f6d3d006e9cb2eb0d3177ce90527dd138abf36d95c3f98184399a6d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im ZhuDongFangYu.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1640

memory/960-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download