160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
25-06-2023 06:54

Target

file.exe
Size

288KB
MD5

6ae917525435e23b07d15537fb40aea0
SHA1

7c85b447bb5608ba7fb6a332c033c0cdad0430ae
SHA256

160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a
SHA512

23e5f94e964d53d72af0d6ad31da309539116a9963806ce7b0d3c028a69ab343df6cd6f3989b280e70a285395425a1cb93492fe5030968558ada5f7de047aaed
SSDEEP

6144:Ft+WQdzUUPFTf2HHvKlHQho0jT21v3Ifz/x2ShelxPcWpv:61oqm+QbjTIwr/l00m

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2020 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2020 powershell.exe

pid	process
2020	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2020	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1016 wrote to memory of 2020	1016	file.exe	powershell.exe
PID 1016 wrote to memory of 2020	1016	file.exe	powershell.exe
PID 1016 wrote to memory of 2020	1016	file.exe	powershell.exe
PID 1016 wrote to memory of 2020	1016	file.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1016

memory/1016-54-0x0000000000BD0000-0x0000000000C1C000-memory.dmp

Filesize
304KB

Download
memory/1016-55-0x0000000004C90000-0x0000000004CD0000-memory.dmp

Filesize
256KB

Download
memory/1016-60-0x0000000004C90000-0x0000000004CD0000-memory.dmp

Filesize
256KB

Download
memory/2020-59-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download
memory/2020-58-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download