4536579cee89a758c84d47a888082e23144de75a19bb0f7096f994ea346cef78

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 13:07

Target

b8cda93c41b564c86f88c2ed9401eb8a.exe
Size

89KB
MD5

b8cda93c41b564c86f88c2ed9401eb8a
SHA1

e09986e206d7d8b76ecdcad1b67bb00242f7bc9b
SHA256

4536579cee89a758c84d47a888082e23144de75a19bb0f7096f994ea346cef78
SHA512

bcc3a13e1c3894b82cc36ec7d24bf6e67a18c44564a9ae06a2d0b449a4ee2b6e6d3a456a311d7a6b165eac1718e29530e9a69bdcdf1aefe41bafd7b060718569
SSDEEP

1536:wZYlPuU+bLpdSVR39XuZ3Wd2IbpzKOB4WVazUEzODaIj9tCz53VhWQ9+Dt9BZynQ:wZYlPIkR39XuZ3wRK04WVaz7uf9tKWQg

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	b8cda93c41b564c86f88c2ed9401eb8a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2504	1956	b8cda93c41b564c86f88c2ed9401eb8a.exe	29
PID 1956 wrote to memory of 2504	1956	b8cda93c41b564c86f88c2ed9401eb8a.exe	29
PID 1956 wrote to memory of 2504	1956	b8cda93c41b564c86f88c2ed9401eb8a.exe	29
PID 1956 wrote to memory of 2504	1956	b8cda93c41b564c86f88c2ed9401eb8a.exe	29

C:\Users\Admin\AppData\Local\Temp\b8cda93c41b564c86f88c2ed9401eb8a.exe
"C:\Users\Admin\AppData\Local\Temp\b8cda93c41b564c86f88c2ed9401eb8a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 1028
  2⤵
  PID:2504

memory/1956-0-0x0000000074660000-0x0000000074C0B000-memory.dmp

Filesize
5.7MB

Download
memory/1956-1-0x0000000074660000-0x0000000074C0B000-memory.dmp

Filesize
5.7MB

Download
memory/1956-2-0x00000000005D0000-0x0000000000610000-memory.dmp

Filesize
256KB

Download
memory/1956-3-0x00000000005D0000-0x0000000000610000-memory.dmp

Filesize
256KB

Download
memory/1956-6-0x0000000074660000-0x0000000074C0B000-memory.dmp

Filesize
5.7MB

Download
memory/1956-7-0x0000000074660000-0x0000000074C0B000-memory.dmp

Filesize
5.7MB

Download
memory/1956-8-0x00000000005D0000-0x0000000000610000-memory.dmp

Filesize
256KB

Download
memory/1956-9-0x00000000005D0000-0x0000000000610000-memory.dmp

Filesize
256KB

Download
memory/1956-10-0x00000000005D0000-0x0000000000610000-memory.dmp

Filesize
256KB

Download
memory/2504-5-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2504-11-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download