9329231106a8e61f637ed1a70b63c43429870912bbbba155dbb4b839b05c464a

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2023, 05:14

Target

DAO-Servicecontrol.exe
Size

12KB
MD5

9b54d43b6b95f60ba7f7c5439ece7d01
SHA1

07f5a1127759b47ef85d04c184b00371f2b954e7
SHA256

1d5d1c80cf72350edac948e9142ab9c95f33bbe8278367ca5b17529faad7b4d9
SHA512

b74206883aa1264d9842d833adeb935b32d31d9fcd877bd740d7b7f953739fa83b39cdcafc130625f29cad40ee98b4ede56932fba768113636aba8040be53a8b
SSDEEP

192:qALXVqT9WoupxZVGnlYJLLtIDLTypcuBr4ExWCS+RszYcCeW:qALlG9RupbZ1+LTymAbxWCS+CzYcCeW

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4000	2960	DAO-Servicecontrol.exe	87
PID 2960 wrote to memory of 4000	2960	DAO-Servicecontrol.exe	87
PID 2960 wrote to memory of 4000	2960	DAO-Servicecontrol.exe	87

C:\Users\Admin\AppData\Local\Temp\DAO-Servicecontrol.exe
"C:\Users\Admin\AppData\Local\Temp\DAO-Servicecontrol.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 900
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4000

memory/2960-133-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/2960-134-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/2960-135-0x00000000010E0000-0x00000000010F0000-memory.dmp

Filesize
64KB

Download
memory/2960-142-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download