ecc0f2aa29b102bf8d67b7d7173e8698c0341ddfdf9757be17595460fbf1791a

Analysis

max time kernel
150s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/06/2023, 19:57

Target

tmp.exe
Size

1.3MB
MD5

bb0a8181cb76088caee8b4adb018fdf6
SHA1

f02032a8f37dd17efa1bed4e6d3944dfc4caea34
SHA256

ecc0f2aa29b102bf8d67b7d7173e8698c0341ddfdf9757be17595460fbf1791a
SHA512

b0772baa30c1b4c2c68f6326d74f579c583eb6160401e816423b1c814b5aa0f5abc4d31bf36094249ba0868d30dca82f7c98ec78bdf0814c8a41860cdc974cf7
SSDEEP

3072:KnroGP0pl2uP7Ndg6WobqMTlqlEZ4tiewyE84joRAmEaCy5AAzO:KnrNPjEgkqsofwyE/kgiAAzO

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1432	tmp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 1416	1432	tmp.exe	29
PID 1432 wrote to memory of 1416	1432	tmp.exe	29
PID 1432 wrote to memory of 1416	1432	tmp.exe	29

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  winleak_spectre.exe -c 1 -f
  2⤵
  PID:1416

memory/1416-55-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-68-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-74-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-58-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-60-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-62-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-64-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-56-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-70-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-66-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-72-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-54-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-76-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-78-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-80-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/1432-82-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download