1657d5cdd4103201ca6213c250d433ba39bc9b05fb0097f51de6502456feb4d0

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2023, 15:14

Target

file.exe
Size

1.6MB
MD5

ad5150bcec261bf10ce708b3126136d1
SHA1

3e8de5e0b43b17627b6bad511ed7c8baa067f609
SHA256

1657d5cdd4103201ca6213c250d433ba39bc9b05fb0097f51de6502456feb4d0
SHA512

67f7338c56b4441d9fe3554093f5b027062fb25b0cae37810e0ef1ed73ba3e8314dca8c6187cc85fe7b8b3c312d4d3ed54d6e77c811b4b95bd96a4c3d31e2c9a
SSDEEP

12288:CWK2LqxWH4YpsfpJW/nklttHxAPrU3pSqclZUyeg0nZ+oB534gSul42C0lYPDshI:CDj0Zez4uwAnbSKd+IbyqosuhgBdQy2

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3152	file.exe
3152	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3152	file.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 3176	3152	file.exe	81
PID 3152 wrote to memory of 3176	3152	file.exe	81
PID 3152 wrote to memory of 3176	3152	file.exe	81

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:3176

memory/3152-132-0x0000022184000000-0x0000022184194000-memory.dmp

Filesize
1.6MB

Download
memory/3152-133-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/3152-134-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download