b23cb04afe59fee16c95ef5d24a67cb493d4ea88b62f6996e54493548acad6c2

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:27

Target

603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe
Size

45KB
MD5

a0c64acfd1267947bc76ff8e44d0bd7c
SHA1

83d882a0ef6536d2bcb19e6754b5c3364c1f4459
SHA256

603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568
SHA512

822dbc0fb22217d693a717a52aa73627ad076a2fd808f1730639dc86324e02a20b1cc740cdec495ea2f55585d10de84a05ea68b66e42f6200fad99d807160d74
SSDEEP

768:Z8Tonah98DUrTu+VxRtR3JKgVdXPauv1yzblwBG:Z8IA98I++bLR3BXfl1yXyc

Score

1^/10

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1116 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1116 taskkill.exe

pid	process
1116	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	1116	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe

description	pid	process	target process
PID 1212 wrote to memory of 1116	1212	603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe	taskkill.exe
PID 1212 wrote to memory of 1116	1212	603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe	taskkill.exe
PID 1212 wrote to memory of 1116	1212	603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe	taskkill.exe
PID 1212 wrote to memory of 1116	1212	603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe
"C:\Users\Admin\AppData\Local\Temp\603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

memory/1212-0-0x0000000001290000-0x00000000012A4000-memory.dmp

Filesize
80KB

Download
memory/1212-1-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/1212-2-0x00000000011F0000-0x0000000001230000-memory.dmp

Filesize
256KB

Download
memory/1212-122-0x00000000011F0000-0x0000000001230000-memory.dmp

Filesize
256KB

Download
memory/1212-123-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/1212-124-0x00000000011F0000-0x0000000001230000-memory.dmp

Filesize
256KB

Download
memory/1212-125-0x00000000011F0000-0x0000000001230000-memory.dmp

Filesize
256KB

Download