389ad059a6de6e2073a1c9956bebd3740df872ca065d76b02b60abd9dad5a1a5

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 08:45

Target

13ad769e5a85d9e576d5f0125b73afa8.exe
Size

206KB
MD5

13ad769e5a85d9e576d5f0125b73afa8
SHA1

d7eeb17bb3f5b89172eb5464422cf96334a7f8f9
SHA256

389ad059a6de6e2073a1c9956bebd3740df872ca065d76b02b60abd9dad5a1a5
SHA512

649048c20a1defb908ba8b8b141d1cd1a5527726cd97021483554db9062d0c5692c5a8aa5759eddb295656a7c072dce7772820dee571d58198ff6348b9798e3f
SSDEEP

3072:pBHMn/ATxy7gAxa1hji9JEQI00Cj0u3OHShVrlBwo/Rl1uDgkhNtL116OcM:pBHIATxyEAxUwwejtBwo/tuMkn7c

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3740	13ad769e5a85d9e576d5f0125b73afa8

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	13ad769e5a85d9e576d5f0125b73afa8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 3740	2008	13ad769e5a85d9e576d5f0125b73afa8.exe	88
PID 2008 wrote to memory of 3740	2008	13ad769e5a85d9e576d5f0125b73afa8.exe	88
PID 2008 wrote to memory of 3740	2008	13ad769e5a85d9e576d5f0125b73afa8.exe	88
PID 2008 wrote to memory of 3740	2008	13ad769e5a85d9e576d5f0125b73afa8.exe	88

C:\Users\Admin\AppData\Local\Temp\13ad769e5a85d9e576d5f0125b73afa8.exe
"C:\Users\Admin\AppData\Local\Temp\13ad769e5a85d9e576d5f0125b73afa8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\13ad769e5a85d9e576d5f0125b73afa8
  "C:\Users\Admin\AppData\Local\Temp\13ad769e5a85d9e576d5f0125b73afa8"
  2⤵
  - Executes dropped EXE
  PID:3740

C:\Users\Admin\AppData\Local\Temp\13ad769e5a85d9e576d5f0125b73afa8

Filesize
212KB

MD5
c099d753d61e82246ced377dc6ddbbfb

SHA1
23a86f0f263d299301241d677b701414209f859a

SHA256
51acc3604d279525f487f5b3d1c4ebda3bfce06a6d4b76704269602b4593578b

SHA512
35c650f9510ee31c70df62bd128a4ac599af55910ffd4abbb03bac59b30bbd13a4431785c4f9c9b1f8244b3d73a49b32f829f23475bb040b8624516734ed983a

Download Submit
memory/2008-0-0x0000000000400000-0x000000000045CE00-memory.dmp

Filesize
371KB

Download
memory/2008-10-0x0000000000400000-0x000000000045CE00-memory.dmp

Filesize
371KB

Download
memory/3740-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3740-9-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download