f424aedb61c633e0d4bdf34a2062588c3507f2ba9c4f36c0195fb8e346a874b6

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 22:42

Target

10.exe
Size

129KB
MD5

97533d67befc80462eabcb736b8a0b56
SHA1

cdaed91180fbad3953efdaceae98fc56f09c9bd1
SHA256

f424aedb61c633e0d4bdf34a2062588c3507f2ba9c4f36c0195fb8e346a874b6
SHA512

611997dd120b8b31b1beb2a97dd7aa428a4bb5449fffffb988b4461bd0d4b93f939d34eec37591242ea34bdb750c7918d1df272655e4574490b5af865d6067ee
SSDEEP

1536:wCl4Em7dzdmnzdms3sUyOmauXR30eeWfnD4GgR8AUvMFMQiNvRxA4AvtALu3:J+3mnO3FnD4GgR8oSRq4Auu3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2884	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2884	1476	10.exe	29
PID 1476 wrote to memory of 2884	1476	10.exe	29
PID 1476 wrote to memory of 2884	1476	10.exe	29

C:\Users\Admin\AppData\Local\Temp\10.exe
"C:\Users\Admin\AppData\Local\Temp\10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { .\1.ps1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884

memory/1476-13-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2884-5-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2884-4-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2884-7-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2884-8-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2884-10-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/2884-9-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/2884-6-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/2884-11-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/2884-12-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download