b23cb04afe59fee16c95ef5d24a67cb493d4ea88b62f6996e54493548acad6c2

Analysis

max time kernel
174s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 15:27

Target

603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe
Size

45KB
MD5

a0c64acfd1267947bc76ff8e44d0bd7c
SHA1

83d882a0ef6536d2bcb19e6754b5c3364c1f4459
SHA256

603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568
SHA512

822dbc0fb22217d693a717a52aa73627ad076a2fd808f1730639dc86324e02a20b1cc740cdec495ea2f55585d10de84a05ea68b66e42f6200fad99d807160d74
SSDEEP

768:Z8Tonah98DUrTu+VxRtR3JKgVdXPauv1yzblwBG:Z8IA98I++bLR3BXfl1yXyc

Score

1^/10

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2928 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2928 taskkill.exe

pid	process
2928	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2928	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe

description	pid	process	target process
PID 4216 wrote to memory of 2928	4216	603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe	taskkill.exe
PID 4216 wrote to memory of 2928	4216	603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe	taskkill.exe
PID 4216 wrote to memory of 2928	4216	603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe
"C:\Users\Admin\AppData\Local\Temp\603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4216

memory/4216-0-0x0000000075000000-0x00000000757B0000-memory.dmp

Filesize
7.7MB

Download
memory/4216-1-0x00000000006F0000-0x0000000000704000-memory.dmp

Filesize
80KB

Download
memory/4216-2-0x0000000005070000-0x000000000510C000-memory.dmp

Filesize
624KB

Download
memory/4216-3-0x0000000005780000-0x0000000005D24000-memory.dmp

Filesize
5.6MB

Download
memory/4216-4-0x00000000051D0000-0x0000000005262000-memory.dmp

Filesize
584KB

Download
memory/4216-5-0x0000000075000000-0x00000000757B0000-memory.dmp

Filesize
7.7MB

Download
memory/4216-6-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/4216-7-0x00000000051A0000-0x00000000051AA000-memory.dmp

Filesize
40KB

Download
memory/4216-8-0x00000000053C0000-0x0000000005416000-memory.dmp

Filesize
344KB

Download
memory/4216-9-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/4216-10-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/4216-108-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download