2f1e7da8c808181d09957af04b28327869b03dbf462bd4404972a4bde2860989

Resubmissions

29-06-2023 21:02

29-06-2023 17:32

29-06-2023 17:23

max time kernel
89s
max time network
80s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29-06-2023 17:23

Target

test.exe
Size

4KB
MD5

e4df89514610e82a6884fd92ddab45f8
SHA1

36228c8b0906670639df4f520bd18906c011da72
SHA256

2f1e7da8c808181d09957af04b28327869b03dbf462bd4404972a4bde2860989
SHA512

6b26029f1742bfe186add5220c2f6a46ed24b10b8960881dc7d9a0b31c88dd4d8723352747241f28a7af297211f181faaa3d65a4f605b168d0232988093d86fc

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1612	AUDIODG.EXE
Token: 33	1612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1612	AUDIODG.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

test.exetest.exetest.exe

description	pid	process	target process
PID 680 wrote to memory of 1564	680	test.exe	dw20.exe
PID 680 wrote to memory of 1564	680	test.exe	dw20.exe
PID 680 wrote to memory of 1564	680	test.exe	dw20.exe
PID 1748 wrote to memory of 1280	1748	test.exe	dw20.exe
PID 1748 wrote to memory of 1280	1748	test.exe	dw20.exe
PID 1748 wrote to memory of 1280	1748	test.exe	dw20.exe
PID 1052 wrote to memory of 2004	1052	test.exe	dw20.exe
PID 1052 wrote to memory of 2004	1052	test.exe	dw20.exe
PID 1052 wrote to memory of 2004	1052	test.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 952
2⤵
PID:1564

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x450
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 948
2⤵
PID:1280

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 952
2⤵
PID:2004

memory/680-54-0x0000000000D00000-0x0000000000D08000-memory.dmp

Filesize
32KB

Download
memory/680-55-0x00000000005E0000-0x0000000000660000-memory.dmp

Filesize
512KB

Download
memory/1052-60-0x0000000001340000-0x0000000001348000-memory.dmp

Filesize
32KB

Download
memory/1052-61-0x0000000000B20000-0x0000000000BA0000-memory.dmp

Filesize
512KB

Download
memory/1280-59-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1564-56-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

Filesize
4KB

Download
memory/1748-57-0x0000000000FA0000-0x0000000000FA8000-memory.dmp

Filesize
32KB

Download
memory/1748-58-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2004-62-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download