9b8823dcdaeeea59ec64f4718bff9619d1d0c24e4953a0002d6dc96a12f330be

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2023 06:09

Target

D09865445789-0987654.exe
Size

348KB
MD5

209131b7f5c017d2ed3ca9bb8789d9cf
SHA1

79d95012a5f433239d81563ebd1a501a0443194a
SHA256

9b8823dcdaeeea59ec64f4718bff9619d1d0c24e4953a0002d6dc96a12f330be
SHA512

44add1c3141d812ac6976a1eadbd777e4750f633640718866211a34cb3c4fb8951ec31dc8413a8c6a00b635e740e8dc94c9f0ce7b688fafa14b126cf734e5a9a
SSDEEP

6144:vr9BIKD2SJMzodRpUZNFvz32LBWd9mxMzIqz8q/Qvt3mkscDdk6ceh9X3P9:BfD2S+j5ZTSD5k6ceX

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 676 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	676	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

D09865445789-0987654.exe

description	pid	process	target process
PID 1360 wrote to memory of 4572	1360	D09865445789-0987654.exe	D09865445789-0987654.exe
PID 1360 wrote to memory of 4572	1360	D09865445789-0987654.exe	D09865445789-0987654.exe
PID 1360 wrote to memory of 4572	1360	D09865445789-0987654.exe	D09865445789-0987654.exe

C:\Users\Admin\AppData\Local\Temp\D09865445789-0987654.exe
"C:\Users\Admin\AppData\Local\Temp\D09865445789-0987654.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Users\Admin\AppData\Local\Temp\D09865445789-0987654.exe
C:\Users\Admin\AppData\Local\Temp\D09865445789-0987654.exe
2⤵
PID:4572

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:676

memory/676-10-0x000001B094B90000-0x000001B094BA0000-memory.dmp

Filesize
64KB

Download
memory/676-46-0x000001B09D140000-0x000001B09D141000-memory.dmp

Filesize
4KB

Download
memory/676-45-0x000001B09D030000-0x000001B09D031000-memory.dmp

Filesize
4KB

Download
memory/676-44-0x000001B09D030000-0x000001B09D031000-memory.dmp

Filesize
4KB

Download
memory/676-42-0x000001B09D000000-0x000001B09D001000-memory.dmp

Filesize
4KB

Download
memory/676-26-0x000001B094C90000-0x000001B094CA0000-memory.dmp

Filesize
64KB

Download
memory/1360-3-0x00000000055C0000-0x0000000005652000-memory.dmp

Filesize
584KB

Download
memory/1360-7-0x0000000005590000-0x000000000559A000-memory.dmp

Filesize
40KB

Download
memory/1360-9-0x0000000074990000-0x0000000075140000-memory.dmp

Filesize
7.7MB

Download
memory/1360-6-0x0000000005760000-0x00000000057FC000-memory.dmp

Filesize
624KB

Download
memory/1360-5-0x0000000005750000-0x0000000005760000-memory.dmp

Filesize
64KB

Download
memory/1360-4-0x0000000005520000-0x0000000005574000-memory.dmp

Filesize
336KB

Download
memory/1360-0-0x0000000000B00000-0x0000000000B5E000-memory.dmp

Filesize
376KB

Download
memory/1360-2-0x0000000005AD0000-0x0000000006074000-memory.dmp

Filesize
5.6MB

Download
memory/1360-1-0x0000000074990000-0x0000000075140000-memory.dmp

Filesize
7.7MB

Download