a9a16c8cc0135626137c4e3d1fce076429fe7167b30bf0313fb58812ad65d530

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 12:18

Target

97224caea74c8036d4597efb170a0013.exe
Size

1.9MB
MD5

97224caea74c8036d4597efb170a0013
SHA1

b55e385c561a65509b49c1c52394443b65d7c791
SHA256

a9a16c8cc0135626137c4e3d1fce076429fe7167b30bf0313fb58812ad65d530
SHA512

d0025b5d144988275fce343ea48d0239d9b82fa4ba857d1f1d3a8bef23d48c82a50d78ad78e7d5a9d1f6595b02195f1d3ab47f7c1bdf752453f547db1c801366
SSDEEP

12288:p5274pKyhXzHkuoG+R6kNOS13IVAz7X/yEWUwkFKj5umynYV2rcD5/T9y0rqB79D:p13hm63S13ISv/vPFKIR6NrI7VV1Upq

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1132	97224caea74c8036d4597efb170a0013.exe
1132	97224caea74c8036d4597efb170a0013.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	97224caea74c8036d4597efb170a0013.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 4516	1132	97224caea74c8036d4597efb170a0013.exe	85
PID 1132 wrote to memory of 4516	1132	97224caea74c8036d4597efb170a0013.exe	85
PID 1132 wrote to memory of 4516	1132	97224caea74c8036d4597efb170a0013.exe	85

C:\Users\Admin\AppData\Local\Temp\97224caea74c8036d4597efb170a0013.exe
"C:\Users\Admin\AppData\Local\Temp\97224caea74c8036d4597efb170a0013.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del /Q C:\Windows\system32\*.ime
  2⤵
  PID:4516

memory/1132-0-0x0000000000870000-0x0000000000A61000-memory.dmp

Filesize
1.9MB

Download
memory/1132-1-0x0000000000400000-0x000000000058D000-memory.dmp

Filesize
1.6MB

Download
memory/1132-6-0x0000000000400000-0x000000000058D000-memory.dmp

Filesize
1.6MB

Download
memory/1132-7-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Filesize
4KB

Download
memory/1132-8-0x0000000000400000-0x000000000058D000-memory.dmp

Filesize
1.6MB

Download
memory/1132-9-0x0000000000400000-0x000000000058D000-memory.dmp

Filesize
1.6MB

Download
memory/1132-10-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Filesize
4KB

Download