46218700e3edead893b37eeb0cfc7599b915761bcb65ef97789b51f708be1b4e

Analysis

max time kernel
92s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2023, 16:08

Target
bN5L.exe
Size 32KB
Sample230615-tk74vaad88
SHA256 46218700e3edead893b37eeb0cfc7599b915761bcb65ef97789b51f708be1b4e
MD5 7066be7fb0ed23353f8bc2a9f9dc4456
SHA1 950bc1afd2e73cf74cce6a56112778260dcef347
SHA512 3ba6727bc603455218b0cb7faeafade2d498a922978382523554db181f9b00aba3b19e651798b3fc44a32e22eaa0f74ad1251e156aa61157f39e801edda20077
SSDEEP 384:40bUe5XB4e0XnOZzw0Q0mS03AWTxtTUFQqzFYObbV:NT9BuOC55d+bV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	bN5L.exe
Token: 33	3984	bN5L.exe
Token: SeIncBasePriorityPrivilege	3984	bN5L.exe
Token: 33	3984	bN5L.exe
Token: SeIncBasePriorityPrivilege	3984	bN5L.exe
Token: 33	3984	bN5L.exe
Token: SeIncBasePriorityPrivilege	3984	bN5L.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 1896	3984	bN5L.exe	87
PID 3984 wrote to memory of 1896	3984	bN5L.exe	87
PID 3984 wrote to memory of 1896	3984	bN5L.exe	87

C:\Users\Admin\AppData\Local\Temp\bN5L.exe
"C:\Users\Admin\AppData\Local\Temp\bN5L.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\bN5L.exe"
  2⤵
  PID:1896

memory/3984-133-0x0000000001030000-0x0000000001040000-memory.dmp

Download

memory/3984-134-0x0000000001030000-0x0000000001040000-memory.dmp

Download

memory/3984-135-0x0000000001030000-0x0000000001040000-memory.dmp

Download