437e1e9d471118c296359bcfc1d6b3a197d36d11e37727a380ef7a09632509d9

Analysis

max time kernel
1406s
max time network
1228s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2023 02:43

Target

xmrig-6.18.1/benchmark_10M.cmd
Size

56B
MD5

14b1ce42ded2df03638180864e4d056f
SHA1

cbc1b3edd1942630f6363f3ccae574283b14c260
SHA256

bdec0d2ea20decc25659f26c7bfd7a78fb0e51cc100443b8a35c43206d2eb86a
SHA512

d8297c2728245b570ad71b8062a17e28e2d9e72bf8be773bb92828e57912cdd0a6ec35fe244069a5fdaf3be8cfe3997c403ea551b81be5708dd80c6eb5f6e458

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
644	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4136	xmrig.exe
Token: SeLockMemoryPrivilege	4136	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4136	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4136	4972	cmd.exe	82
PID 4972 wrote to memory of 4136	4972	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\benchmark_10M.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
  xmrig.exe --bench=10M --submit
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4136

memory/4136-133-0x000001D239AF0000-0x000001D239B10000-memory.dmp

Filesize
128KB

Download
memory/4136-134-0x000001D2CBB70000-0x000001D2CBBB0000-memory.dmp

Filesize
256KB

Download
memory/4136-135-0x000001D2CC310000-0x000001D2CC330000-memory.dmp

Filesize
128KB

Download
memory/4136-136-0x000001D2CC540000-0x000001D2CC560000-memory.dmp

Filesize
128KB

Download
memory/4136-137-0x000001D2CC310000-0x000001D2CC330000-memory.dmp

Filesize
128KB

Download
memory/4136-138-0x000001D2CC540000-0x000001D2CC560000-memory.dmp

Filesize
128KB

Download