a341d8f1aef7b96d07b359b03af30947947813291a98ad5990d7ebd4c3e97f6b

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23-08-2023 14:53

Target

ground.exe
Size

263KB
MD5

e51b95dc4715e4d974666531bb10f31a
SHA1

7dc83cc5104d626c58b1f7f98e41126acfb6aade
SHA256

a341d8f1aef7b96d07b359b03af30947947813291a98ad5990d7ebd4c3e97f6b
SHA512

b8309f5f4a24f2459365e5cfd8fb020760478680dcaa8bafd6126ed230b393b9d220c9f5e2281b8691de7474bb880c22e342e01e832c7279a146f89d7b17f5e2
SSDEEP

6144:fg/TeGnpOGadbuh2tuQrUoCcYV3A/HZPlf:I/CGnpXadbcQowYtK9

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2040	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2040	1972	ground.exe	28
PID 1972 wrote to memory of 2040	1972	ground.exe	28
PID 1972 wrote to memory of 2040	1972	ground.exe	28
PID 1972 wrote to memory of 2040	1972	ground.exe	28

C:\Users\Admin\AppData\Local\Temp\ground.exe
"C:\Users\Admin\AppData\Local\Temp\ground.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2040

memory/1972-0-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download
memory/1972-1-0x0000000001220000-0x0000000001266000-memory.dmp

Filesize
280KB

Download
memory/1972-2-0x00000000046E0000-0x0000000004720000-memory.dmp

Filesize
256KB

Download
memory/1972-10-0x00000000046E0000-0x0000000004720000-memory.dmp

Filesize
256KB

Download
memory/1972-9-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download
memory/2040-8-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2040-7-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-6-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-5-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-11-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-12-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2040-13-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2040-14-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download