2e55752a5ce424f78521951780658ea572e78920fab1980c5047eb543d3dbec8

Analysis

max time kernel
1403s
max time network
1229s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2023 19:16

Target

SysApps/benchmark_10M.cmd
Size

56B
MD5

14b1ce42ded2df03638180864e4d056f
SHA1

cbc1b3edd1942630f6363f3ccae574283b14c260
SHA256

bdec0d2ea20decc25659f26c7bfd7a78fb0e51cc100443b8a35c43206d2eb86a
SHA512

d8297c2728245b570ad71b8062a17e28e2d9e72bf8be773bb92828e57912cdd0a6ec35fe244069a5fdaf3be8cfe3997c403ea551b81be5708dd80c6eb5f6e458

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4056	xmrig.exe
Token: SeLockMemoryPrivilege	4056	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4056	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4056	4884	cmd.exe	81
PID 4884 wrote to memory of 4056	4884	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SysApps\benchmark_10M.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\SysApps\xmrig.exe
  xmrig.exe --bench=10M --submit
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4056

memory/4056-133-0x000001ACEEB10000-0x000001ACEEB30000-memory.dmp

Filesize
128KB

Download
memory/4056-134-0x000001ACF0420000-0x000001ACF0460000-memory.dmp

Filesize
256KB

Download
memory/4056-135-0x000001ACF0460000-0x000001ACF0480000-memory.dmp

Filesize
128KB

Download
memory/4056-136-0x000001ACF0480000-0x000001ACF04A0000-memory.dmp

Filesize
128KB

Download
memory/4056-137-0x000001ACF0460000-0x000001ACF0480000-memory.dmp

Filesize
128KB

Download
memory/4056-138-0x000001ACF0480000-0x000001ACF04A0000-memory.dmp

Filesize
128KB

Download