e2b49edc63d7ea17003ed53cd56e415b366e1a9ab7ee2fb7e0619f6a476933c8

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 13:30

Target

21d789e77c2baf3dcde2a45e1669a23a.exe
Size

8KB
MD5

21d789e77c2baf3dcde2a45e1669a23a
SHA1

1c88d8bffd792ffeef9e086e3b258fe56e4b0243
SHA256

e2b49edc63d7ea17003ed53cd56e415b366e1a9ab7ee2fb7e0619f6a476933c8
SHA512

18f1389d2fabb0e66eb1aeab30e15d52e18e997e6c3861f6f85b42039d792c5f09d1de1c0684955ca62d5685bbc327849a5da08a0fe14f8efcc88bc901fb22b3
SSDEEP

96:avaEeYYdDLiPoHQjzQMLy+hcMCqKjgbvGwPgYOEMPBvz+ebMeV+GNMVg8J:avUNyowJL/aMjGwP7PMZvz+ebMeFMVV

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1752	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1752	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1752	msiexec.exe
1752	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1752	2192	21d789e77c2baf3dcde2a45e1669a23a.exe	17
PID 2192 wrote to memory of 1752	2192	21d789e77c2baf3dcde2a45e1669a23a.exe	17
PID 2192 wrote to memory of 1752	2192	21d789e77c2baf3dcde2a45e1669a23a.exe	17
PID 2192 wrote to memory of 1752	2192	21d789e77c2baf3dcde2a45e1669a23a.exe	17
PID 2192 wrote to memory of 1752	2192	21d789e77c2baf3dcde2a45e1669a23a.exe	17
PID 2192 wrote to memory of 1752	2192	21d789e77c2baf3dcde2a45e1669a23a.exe	17
PID 2192 wrote to memory of 1752	2192	21d789e77c2baf3dcde2a45e1669a23a.exe	17

C:\Users\Admin\AppData\Local\Temp\21d789e77c2baf3dcde2a45e1669a23a.exe
"C:\Users\Admin\AppData\Local\Temp\21d789e77c2baf3dcde2a45e1669a23a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\msiexec.exe
  msiexec /i 64.msi
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1752