5cf0b62e76db6b5908a7ceee65fb4e56e00e0b5eed382ee0930d6c373913c965

Analysis

max time kernel
13s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 18:35

Target

34e7ff4e91e7fe0a95d5dba92724847a.exe
Size

1.8MB
MD5

34e7ff4e91e7fe0a95d5dba92724847a
SHA1

c626fe4891d256e2f7aaa5d177f3dfe950e89923
SHA256

5cf0b62e76db6b5908a7ceee65fb4e56e00e0b5eed382ee0930d6c373913c965
SHA512

eb3b749f0d7de30b7fc0e990b626f0388f24a1d2626fa9d954855b66cd5c489c43ca105e8b498810b79a1628b4967bd491990f986962ac4e2db2626642a0cfa6
SSDEEP

49152:Bpd323io5Ie1DasY6DwOBfrnvV7UeWtcI:Bpd323N5r9YiwOBpIeWF

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	3384	dw20.exe
Token: SeBackupPrivilege	3384	dw20.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 3384	816	34e7ff4e91e7fe0a95d5dba92724847a.exe	95
PID 816 wrote to memory of 3384	816	34e7ff4e91e7fe0a95d5dba92724847a.exe	95

C:\Users\Admin\AppData\Local\Temp\34e7ff4e91e7fe0a95d5dba92724847a.exe
"C:\Users\Admin\AppData\Local\Temp\34e7ff4e91e7fe0a95d5dba92724847a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 1192
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3384

memory/816-2-0x0000000001AF0000-0x0000000001B00000-memory.dmp

Filesize
64KB

Download
memory/816-4-0x00007FFA16D60000-0x00007FFA17701000-memory.dmp

Filesize
9.6MB

Download
memory/816-5-0x00000000018C0000-0x00000000018C8000-memory.dmp

Filesize
32KB

Download
memory/816-3-0x000000001BF30000-0x000000001BFCC000-memory.dmp

Filesize
624KB

Download
memory/816-1-0x000000001C520000-0x000000001C9EE000-memory.dmp

Filesize
4.8MB

Download
memory/816-0-0x00007FFA16D60000-0x00007FFA17701000-memory.dmp

Filesize
9.6MB

Download
memory/816-14-0x00007FFA16D60000-0x00007FFA17701000-memory.dmp

Filesize
9.6MB

Download