1767126f35737c858d2d4abf0c5b109447b3a25eac6ab98782f9528fc1d88179

Analysis

max time kernel
150s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 12:44

Target

369316e575cc105bf300d63226392410.exe
Size

65KB
MD5

369316e575cc105bf300d63226392410
SHA1

aeb9116975d7bfeb001d9ad5a2bc0590336ea9d9
SHA256

1767126f35737c858d2d4abf0c5b109447b3a25eac6ab98782f9528fc1d88179
SHA512

b8ba53037685de3c5a0924eae1c0d2d296a63341ba1ef6a71a0570c880031c194b37e68385f1c37a4c29ba5e0eb98bf8f0856d6f0e29b1b1667858f374ae5cd5
SSDEEP

1536:jtf77AEBaoVsz16Anz3pIFhy55KChEE1o3q3G/h95:jOEBaoVsx6An7ucBeq6

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3216	369316e575cc105bf300d63226392410.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 2328	3216	369316e575cc105bf300d63226392410.exe	93
PID 3216 wrote to memory of 2328	3216	369316e575cc105bf300d63226392410.exe	93
PID 3216 wrote to memory of 2328	3216	369316e575cc105bf300d63226392410.exe	93

C:\Users\Admin\AppData\Local\Temp\369316e575cc105bf300d63226392410.exe
"C:\Users\Admin\AppData\Local\Temp\369316e575cc105bf300d63226392410.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\arp.exe
  "C:\Windows\System32\arp.exe" -a
  2⤵
  PID:2328

memory/3216-0-0x0000000000DD0000-0x0000000000DE6000-memory.dmp

Filesize
88KB

Download
memory/3216-1-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download
memory/3216-2-0x0000000005700000-0x0000000005776000-memory.dmp

Filesize
472KB

Download
memory/3216-3-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/3216-4-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download