48d4f1b3f8a8466d2f81ebaad6776a4032f726f36150bde081683fba92b32159

Analysis

max time kernel
101s
max time network
144s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08/06/2023, 19:51

Target

Client.exe
Size

6KB
MD5

024b13b3d002dae55ca55b7dac6b0648
SHA1

7bc7873b9378703b3a0bb02ff944771fadc1a24d
SHA256

48d4f1b3f8a8466d2f81ebaad6776a4032f726f36150bde081683fba92b32159
SHA512

b3e09502de7bc6f58243cda88b391b7262cf8584d04c9025e4d85e977296d01187fea34b95be4a5b2a9349870f7e61a15e8945a29ac7ee368977ce84728db1f7
SSDEEP

96:fkczt+lBNm97n4UHLluH0xiR5bbLGv11IuLBfzNt:fkgtb4SLoXfLGv11Iu9J

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
524	powershell.exe
524	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	524	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 524	2028	Client.exe	27
PID 2028 wrote to memory of 524	2028	Client.exe	27
PID 2028 wrote to memory of 524	2028	Client.exe	27
PID 2028 wrote to memory of 524	2028	Client.exe	27
PID 524 wrote to memory of 1244	524	powershell.exe	29
PID 524 wrote to memory of 1244	524	powershell.exe	29
PID 524 wrote to memory of 1244	524	powershell.exe	29
PID 524 wrote to memory of 1244	524	powershell.exe	29

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" start notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\system32\notepad.exe"
    3⤵
    PID:1244

memory/524-58-0x00000000027F0000-0x0000000002830000-memory.dmp

Filesize
256KB

Download
memory/2028-54-0x0000000000940000-0x0000000000948000-memory.dmp

Filesize
32KB

Download
memory/2028-55-0x0000000002000000-0x0000000002040000-memory.dmp

Filesize
256KB

Download