c1140b465af0736dd58eadbe9c4b6fee0f87a4b6d6a08cf69f11ca88361dfc2c

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/04/2023, 19:59

Target

c1140b465af0736dd58eadbe9c4b6fee0f87a4b6d6a08cf69f11ca88361dfc2c.exe
Size

36KB
MD5

6668c74d87ccf3d537204476b94297d2
SHA1

0d6d1c927bdd1cb8754304259be07532744e73a8
SHA256

c1140b465af0736dd58eadbe9c4b6fee0f87a4b6d6a08cf69f11ca88361dfc2c
SHA512

742dca821f6371a45bb4c67446fd642ee27e12c6d85690fe89ec5ad42d9534dd94d2369048888ca4ed17843b61581faeaa6ea6d7734fef5612eb7f9368f18689
SSDEEP

384:Ad2aW54LfpqRIWr0flRF01j3T8MgprQBktR5JcqXQma:Jas4LRqRIPKxQMoQBkT5C4

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
2032	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1948	c1140b465af0736dd58eadbe9c4b6fee0f87a4b6d6a08cf69f11ca88361dfc2c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1172	1948	c1140b465af0736dd58eadbe9c4b6fee0f87a4b6d6a08cf69f11ca88361dfc2c.exe	27
PID 1948 wrote to memory of 1172	1948	c1140b465af0736dd58eadbe9c4b6fee0f87a4b6d6a08cf69f11ca88361dfc2c.exe	27
PID 1948 wrote to memory of 1172	1948	c1140b465af0736dd58eadbe9c4b6fee0f87a4b6d6a08cf69f11ca88361dfc2c.exe	27
PID 1948 wrote to memory of 1172	1948	c1140b465af0736dd58eadbe9c4b6fee0f87a4b6d6a08cf69f11ca88361dfc2c.exe	27
PID 1172 wrote to memory of 2032	1172	cmd.exe	29
PID 1172 wrote to memory of 2032	1172	cmd.exe	29
PID 1172 wrote to memory of 2032	1172	cmd.exe	29
PID 1172 wrote to memory of 2032	1172	cmd.exe	29