160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a

Resubmissions

25-06-2023 05:35

25-06-2023 05:27

25-06-2023 04:47

max time kernel
29s
max time network
31s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
25-06-2023 05:35

Target

160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe
Size

288KB
MD5

6ae917525435e23b07d15537fb40aea0
SHA1

7c85b447bb5608ba7fb6a332c033c0cdad0430ae
SHA256

160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a
SHA512

23e5f94e964d53d72af0d6ad31da309539116a9963806ce7b0d3c028a69ab343df6cd6f3989b280e70a285395425a1cb93492fe5030968558ada5f7de047aaed
SSDEEP

6144:Ft+WQdzUUPFTf2HHvKlHQho0jT21v3Ifz/x2ShelxPcWpv:61oqm+QbjTIwr/l00m

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

840 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 840 powershell.exe

pid	process
840	powershell.exe

description	pid	process
Token: SeDebugPrivilege	840	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe

description	pid	process	target process
PID 2040 wrote to memory of 840	2040	160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe	powershell.exe
PID 2040 wrote to memory of 840	2040	160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe	powershell.exe
PID 2040 wrote to memory of 840	2040	160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe	powershell.exe
PID 2040 wrote to memory of 840	2040	160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe
"C:\Users\Admin\AppData\Local\Temp\160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

memory/840-58-0x0000000002480000-0x00000000024C0000-memory.dmp

Filesize
256KB

Download
memory/2040-54-0x0000000000BC0000-0x0000000000C0C000-memory.dmp

Filesize
304KB

Download
memory/2040-55-0x0000000000B80000-0x0000000000BC0000-memory.dmp

Filesize
256KB

Download
memory/2040-59-0x0000000000B80000-0x0000000000BC0000-memory.dmp

Filesize
256KB

Download