5015faf9c0e0dcd123921601098ba7012c55dd6e7cee2d019f472fefb741cf14

Analysis

max time kernel
64s
max time network
67s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16-01-2023 02:31

Target

140a3db74e15063ceb5837b3d030b03b.exe
Size

72KB
MD5

140a3db74e15063ceb5837b3d030b03b
SHA1

4bcd41839627c05ec948a55904d0b4a50a3097e9
SHA256

5015faf9c0e0dcd123921601098ba7012c55dd6e7cee2d019f472fefb741cf14
SHA512

c8e8ed7161bea42291fda2df814affda6a06298720e0c8e763c9c520175c676c10f48d1880c233ad2e12ab8c8658f7ab157f5f6489a2faf5a5ad7d4bc60b60e9
SSDEEP

768:Rwfar1qIZ8HaNpuXX23X9qiphPZflwNdsl6VNt423htEJPxw:RwMPZ8HupunmNqIBflisl6Nt42xoPxw

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\140a3db74e15063ceb5837b3d030b03b.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\140a3db74e15063ceb5837b3d030b03b.exe	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	140a3db74e15063ceb5837b3d030b03b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 752	1216	140a3db74e15063ceb5837b3d030b03b.exe	28
PID 1216 wrote to memory of 752	1216	140a3db74e15063ceb5837b3d030b03b.exe	28
PID 1216 wrote to memory of 752	1216	140a3db74e15063ceb5837b3d030b03b.exe	28

C:\Users\Admin\AppData\Local\Temp\140a3db74e15063ceb5837b3d030b03b.exe
"C:\Users\Admin\AppData\Local\Temp\140a3db74e15063ceb5837b3d030b03b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  - Drops startup file
  PID:752

memory/752-57-0x0000000000000000-mapping.dmp

Download
memory/1216-54-0x0000000000990000-0x00000000009A6000-memory.dmp

Filesize
88KB

Download
memory/1216-55-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Filesize
8KB

Download
memory/1216-56-0x000000001ADA6000-0x000000001ADC5000-memory.dmp

Filesize
124KB

Download
memory/1216-58-0x000000001ADA6000-0x000000001ADC5000-memory.dmp

Filesize
124KB

Download