7d7cb41e32c6c2efc5086dfcfa158c6055dda05e275eedf818c144d546d415ac

Analysis

max time kernel
0s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 06:59

Target

119d8b08920e30890d0819d221eebe02.exe
Size

178KB
MD5

119d8b08920e30890d0819d221eebe02
SHA1

91252ee581a98931954200a3e8ceabc875bbf91d
SHA256

7d7cb41e32c6c2efc5086dfcfa158c6055dda05e275eedf818c144d546d415ac
SHA512

782f60c906d48dbdcbbc841a9f0875c58a00ec4cfd54fd5a10ea04f073bb34df03ad825abf577e8763b8384979cacff267c0ccf0acbdb19dfc11e2d1467b2539
SSDEEP

3072:gaRVSzWg0o+YX950aS/9jxhmBnFYnYljpnps6mguEOtucSH7MgyNZCRj+iWTmN:gaRVOWg0o+YX950aSjxwnFYYljpu6PcO

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 4784	4536	119d8b08920e30890d0819d221eebe02.exe	19
PID 4536 wrote to memory of 4784	4536	119d8b08920e30890d0819d221eebe02.exe	19
PID 4536 wrote to memory of 4784	4536	119d8b08920e30890d0819d221eebe02.exe	19

C:\Users\Admin\AppData\Local\Temp\119d8b08920e30890d0819d221eebe02.exe
"C:\Users\Admin\AppData\Local\Temp\119d8b08920e30890d0819d221eebe02.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 884
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4784

memory/4536-1-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download
memory/4536-2-0x0000000074920000-0x0000000074ED1000-memory.dmp

Filesize
5.7MB

Download
memory/4536-0-0x0000000074920000-0x0000000074ED1000-memory.dmp

Filesize
5.7MB

Download
memory/4536-9-0x0000000074920000-0x0000000074ED1000-memory.dmp

Filesize
5.7MB

Download