741caf817c710f9ad88771cf4d0b0fa48752769d2c22f89b08390755ae0eb8bf

Analysis

max time kernel
142s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 20:37

Target

3bcb89b4b4bd431ad73f24cc9e41dcab.exe
Size

6.9MB
MD5

3bcb89b4b4bd431ad73f24cc9e41dcab
SHA1

2374d530f6203d94d63903fceee29d7c8e848921
SHA256

741caf817c710f9ad88771cf4d0b0fa48752769d2c22f89b08390755ae0eb8bf
SHA512

43d02879463438980f7eb94dc90657d47674d3b8498ba595cb5a10672c4918abac7ebfb56b597454689ae5a263a275e6d0819431e0c02c585fbfb3807ac01ad6
SSDEEP

98304:REbzR+d95O8P5ylPfXdOVL9ofwVwtFJil5vDx9T4K54O4ki66TMuaiE9KfrKpsI1:+bzRU957Byl3MXcq5f4Qi64Mu1YKns

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	376	3bcb89b4b4bd431ad73f24cc9e41dcab.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 2548	376	3bcb89b4b4bd431ad73f24cc9e41dcab.exe	91
PID 376 wrote to memory of 2548	376	3bcb89b4b4bd431ad73f24cc9e41dcab.exe	91
PID 376 wrote to memory of 2548	376	3bcb89b4b4bd431ad73f24cc9e41dcab.exe	91

C:\Users\Admin\AppData\Local\Temp\3bcb89b4b4bd431ad73f24cc9e41dcab.exe
"C:\Users\Admin\AppData\Local\Temp\3bcb89b4b4bd431ad73f24cc9e41dcab.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\SysWOW64\arp.exe
  "C:\Windows\System32\arp.exe" -a
  2⤵
  PID:2548

memory/376-0-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/376-1-0x0000000000180000-0x0000000000866000-memory.dmp

Filesize
6.9MB

Download
memory/376-2-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download
memory/376-3-0x0000000002A30000-0x0000000002A31000-memory.dmp

Filesize
4KB

Download
memory/376-4-0x00000000057D0000-0x0000000005D74000-memory.dmp

Filesize
5.6MB

Download
memory/376-5-0x0000000005220000-0x00000000052B2000-memory.dmp

Filesize
584KB

Download
memory/376-6-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download