160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a

Resubmissions

25-06-2023 05:35

25-06-2023 05:27

25-06-2023 04:47

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
25-06-2023 04:47

Target

160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe
Size

288KB
MD5

6ae917525435e23b07d15537fb40aea0
SHA1

7c85b447bb5608ba7fb6a332c033c0cdad0430ae
SHA256

160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a
SHA512

23e5f94e964d53d72af0d6ad31da309539116a9963806ce7b0d3c028a69ab343df6cd6f3989b280e70a285395425a1cb93492fe5030968558ada5f7de047aaed
SSDEEP

6144:Ft+WQdzUUPFTf2HHvKlHQho0jT21v3Ifz/x2ShelxPcWpv:61oqm+QbjTIwr/l00m

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1196 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1196 powershell.exe

pid	process
1196	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1196	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe

description	pid	process	target process
PID 1276 wrote to memory of 1196	1276	160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe	powershell.exe
PID 1276 wrote to memory of 1196	1276	160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe	powershell.exe
PID 1276 wrote to memory of 1196	1276	160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe	powershell.exe
PID 1276 wrote to memory of 1196	1276	160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe
"C:\Users\Admin\AppData\Local\Temp\160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276

memory/1276-54-0x00000000009B0000-0x00000000009FC000-memory.dmp

Filesize
304KB

Download
memory/1276-55-0x0000000004D40000-0x0000000004D80000-memory.dmp

Filesize
256KB

Download