52a1809773419caafe264fc932eb4dc72f45e59401ea3c3e73072665ae1ada6f

Analysis

max time kernel
135s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2023, 11:06

Target
solm.exe
Size 229KB
Sample230616-m7d1ysef48
SHA256 52a1809773419caafe264fc932eb4dc72f45e59401ea3c3e73072665ae1ada6f
MD5 e5b2eb6d938c08cad96c931c75697d60
SHA1 a5269679ac3c67c26a782cbdaa49ed0b0eaedb1f
SHA512 ead5ecc72380d23d08ee25be70ac33e9a033172125689363bca3ca2f961310e618ccf668b2e1b3edeaa84825429056d6ff7645815f81498da1394cb3c6c50463
SSDEEP 6144:ETA1rj44t8kt9KyjEOnOb/OPQnDAda3wn0/R:T1rj44NIQE0fd5c
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1984	solm.exe
1984	solm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	solm.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 5096	1984	solm.exe	84
PID 1984 wrote to memory of 5096	1984	solm.exe	84
PID 1984 wrote to memory of 5096	1984	solm.exe	84

C:\Users\Admin\AppData\Local\Temp\solm.exe
"C:\Users\Admin\AppData\Local\Temp\solm.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"
  2⤵
  PID:5096

memory/1984-133-0x0000015285B90000-0x0000015285BCE000-memory.dmp

Download

memory/1984-134-0x00000152A0170000-0x00000152A0180000-memory.dmp

Download