aa5a30260cddeba418b4864b57f5021b174730092592a9ec4e7bb7b0a2c00b40

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 05:15

Target

4fad632edc2d19d3a340bdc722c6df26.exe
Size

2.1MB
MD5

4fad632edc2d19d3a340bdc722c6df26
SHA1

99964fead7f90c45b1634c594d1c77a82f62ea75
SHA256

aa5a30260cddeba418b4864b57f5021b174730092592a9ec4e7bb7b0a2c00b40
SHA512

a152149b867cb0c7ac1221988d1375c8a770d3142b2ab5dc6481aca28078c49a164d416e6433125ca8712464f1a2a100bf44b3c684eda78b7bd3b768af87c274
SSDEEP

49152:bfXUpuYQuqi+HjFJNg8xfwoy5yxWXfAB92Jbv4g2MH6U8rTF:bPgQuSHLNVqFXfnv45M9u

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	4fad632edc2d19d3a340bdc722c6df26.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4968	4312	4fad632edc2d19d3a340bdc722c6df26.exe	92
PID 4312 wrote to memory of 4968	4312	4fad632edc2d19d3a340bdc722c6df26.exe	92
PID 4312 wrote to memory of 4968	4312	4fad632edc2d19d3a340bdc722c6df26.exe	92

C:\Users\Admin\AppData\Local\Temp\4fad632edc2d19d3a340bdc722c6df26.exe
"C:\Users\Admin\AppData\Local\Temp\4fad632edc2d19d3a340bdc722c6df26.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\arp.exe
  "C:\Windows\System32\arp.exe" -a
  2⤵
  PID:4968

memory/4312-0-0x0000000074400000-0x0000000074BB0000-memory.dmp

Filesize
7.7MB

Download
memory/4312-1-0x0000000000270000-0x0000000000492000-memory.dmp

Filesize
2.1MB

Download
memory/4312-2-0x00000000072C0000-0x00000000074D4000-memory.dmp

Filesize
2.1MB

Download
memory/4312-3-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Filesize
64KB

Download
memory/4312-4-0x0000000006620000-0x0000000006BC4000-memory.dmp

Filesize
5.6MB

Download
memory/4312-5-0x0000000006210000-0x00000000062A2000-memory.dmp

Filesize
584KB

Download
memory/4312-6-0x0000000074400000-0x0000000074BB0000-memory.dmp

Filesize
7.7MB

Download