46218700e3edead893b37eeb0cfc7599b915761bcb65ef97789b51f708be1b4e

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/06/2023, 16:08

Target
bN5L.exe
Size 32KB
Sample230615-tk74vaad88
SHA256 46218700e3edead893b37eeb0cfc7599b915761bcb65ef97789b51f708be1b4e
MD5 7066be7fb0ed23353f8bc2a9f9dc4456
SHA1 950bc1afd2e73cf74cce6a56112778260dcef347
SHA512 3ba6727bc603455218b0cb7faeafade2d498a922978382523554db181f9b00aba3b19e651798b3fc44a32e22eaa0f74ad1251e156aa61157f39e801edda20077
SSDEEP 384:40bUe5XB4e0XnOZzw0Q0mS03AWTxtTUFQqzFYObbV:NT9BuOC55d+bV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	bN5L.exe
Token: 33	2020	bN5L.exe
Token: SeIncBasePriorityPrivilege	2020	bN5L.exe
Token: 33	2020	bN5L.exe
Token: SeIncBasePriorityPrivilege	2020	bN5L.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1276	2020	bN5L.exe	29
PID 2020 wrote to memory of 1276	2020	bN5L.exe	29
PID 2020 wrote to memory of 1276	2020	bN5L.exe	29
PID 2020 wrote to memory of 1276	2020	bN5L.exe	29

C:\Users\Admin\AppData\Local\Temp\bN5L.exe
"C:\Users\Admin\AppData\Local\Temp\bN5L.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\bN5L.exe"
  2⤵
  PID:1276

memory/2020-54-0x00000000004F0000-0x0000000000530000-memory.dmp

Download

memory/2020-55-0x00000000004F0000-0x0000000000530000-memory.dmp

Download

memory/2020-56-0x00000000004F0000-0x0000000000530000-memory.dmp

Download