8c86affa5fac8b00e17b817fbfa1833c98825b0607c234832ba83262f46137ac

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 06:18

Target

5922f4f4425f872cb51591bbc972b874.exe
Size

555KB
MD5

5922f4f4425f872cb51591bbc972b874
SHA1

46af62bebbddf12081b9e5dbe6acc0a0270146c9
SHA256

8c86affa5fac8b00e17b817fbfa1833c98825b0607c234832ba83262f46137ac
SHA512

d55b7d771378ec5b05ad69d02ccf19e56e95ac1d8e1563cb8bcc167591e1a537ff4b1e8209e711595fdb378b44f4cf0dca44405c304597a80c8e43163d451865
SSDEEP

12288:IcjP/V1FmkLzdXHQPqoFSMX/Mfv5HAsl0pCPJE14Lm7im:IyP/LFm4zRQPjz6xHAohREH7im

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3200	5922f4f4425f872cb51591bbc972b874.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	5922f4f4425f872cb51591bbc972b874.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3544	3200	5922f4f4425f872cb51591bbc972b874.exe	21
PID 3200 wrote to memory of 3544	3200	5922f4f4425f872cb51591bbc972b874.exe	21
PID 3544 wrote to memory of 2244	3544	csc.exe	20
PID 3544 wrote to memory of 2244	3544	csc.exe	20

C:\Users\Admin\AppData\Local\Temp\5922f4f4425f872cb51591bbc972b874.exe
"C:\Users\Admin\AppData\Local\Temp\5922f4f4425f872cb51591bbc972b874.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ltbg1fgn\ltbg1fgn.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3544

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4650.tmp" "c:\Users\Admin\AppData\Local\Temp\ltbg1fgn\CSC140B135E24F745D3B99078E3EF38CE.TMP"
1⤵
PID:2244

memory/3200-0-0x0000000000A20000-0x0000000000AB0000-memory.dmp

Filesize
576KB

Download
memory/3200-3-0x000000001B760000-0x000000001B770000-memory.dmp

Filesize
64KB

Download
memory/3200-2-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3200-13-0x000000001B610000-0x000000001B632000-memory.dmp

Filesize
136KB

Download
memory/3200-1-0x00007FFCB53A0000-0x00007FFCB5E61000-memory.dmp

Filesize
10.8MB

Download
memory/3200-29-0x000000001B760000-0x000000001B770000-memory.dmp

Filesize
64KB

Download
memory/3200-28-0x000000001B760000-0x000000001B770000-memory.dmp

Filesize
64KB

Download
memory/3200-26-0x000000001B6E0000-0x000000001B6E8000-memory.dmp

Filesize
32KB

Download
memory/3200-30-0x00007FFCB53A0000-0x00007FFCB5E61000-memory.dmp

Filesize
10.8MB

Download
memory/3200-31-0x000000001B760000-0x000000001B770000-memory.dmp

Filesize
64KB

Download
memory/3200-32-0x000000001B760000-0x000000001B770000-memory.dmp

Filesize
64KB

Download
memory/3200-33-0x000000001B760000-0x000000001B770000-memory.dmp

Filesize
64KB

Download