e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998

Analysis

max time kernel
65s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2023 20:45

Target

tmprwm0tnp5.exe
Size

1.6MB
MD5

170860057f4aad06ddbeea0ca2b3f1b6
SHA1

db04c735b769df458518f959ae7eca39cfa06213
SHA256

e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998
SHA512

f8bf57126bad026be2414121c798d5688119f06312404c35dea3f457deb717f6422291f5401178586fd23055577f893b4e6236e413c909e3b526c45d3b957766
SSDEEP

24576:uU7taDBzgNEfeEvFTMxdzYPh1ogay/zj1weNgcHFx5MpfTjU/c7jNXPohE:uU7PNBmMxdEvogdzxzHFx+pfTgE7VPI

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	tmprwm0tnp5.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2268	4804	tmprwm0tnp5.exe	90
PID 4804 wrote to memory of 2268	4804	tmprwm0tnp5.exe	90
PID 4804 wrote to memory of 2268	4804	tmprwm0tnp5.exe	90
PID 4804 wrote to memory of 2284	4804	tmprwm0tnp5.exe	91
PID 4804 wrote to memory of 2284	4804	tmprwm0tnp5.exe	91
PID 4804 wrote to memory of 2284	4804	tmprwm0tnp5.exe	91
PID 4804 wrote to memory of 1516	4804	tmprwm0tnp5.exe	92
PID 4804 wrote to memory of 1516	4804	tmprwm0tnp5.exe	92
PID 4804 wrote to memory of 1516	4804	tmprwm0tnp5.exe	92
PID 4804 wrote to memory of 764	4804	tmprwm0tnp5.exe	93
PID 4804 wrote to memory of 764	4804	tmprwm0tnp5.exe	93
PID 4804 wrote to memory of 764	4804	tmprwm0tnp5.exe	93
PID 4804 wrote to memory of 904	4804	tmprwm0tnp5.exe	94
PID 4804 wrote to memory of 904	4804	tmprwm0tnp5.exe	94
PID 4804 wrote to memory of 904	4804	tmprwm0tnp5.exe	94

C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe
"C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe
  "C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"
  2⤵
  PID:2268
- C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe
  "C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"
  2⤵
  PID:2284
- C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe
  "C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"
  2⤵
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe
  "C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"
  2⤵
  PID:764
- C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe
  "C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"
  2⤵
  PID:904

memory/4804-133-0x0000000000D20000-0x0000000000EB6000-memory.dmp

Filesize
1.6MB

Download
memory/4804-134-0x0000000005EE0000-0x0000000006484000-memory.dmp

Filesize
5.6MB

Download
memory/4804-135-0x0000000005930000-0x00000000059C2000-memory.dmp

Filesize
584KB

Download
memory/4804-136-0x0000000005850000-0x000000000585A000-memory.dmp

Filesize
40KB

Download
memory/4804-137-0x0000000005910000-0x0000000005920000-memory.dmp

Filesize
64KB

Download
memory/4804-138-0x0000000005910000-0x0000000005920000-memory.dmp

Filesize
64KB

Download
memory/4804-139-0x0000000007AC0000-0x0000000007B5C000-memory.dmp

Filesize
624KB

Download