cb61ad6d6b82b6e1c3d29cff7c46bcc85a5077aaa6cee2841f8902790554e33c

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 21:03

Target

c1984d0c871a0de78e8dda51cdceffed.exe
Size

88KB
MD5

c1984d0c871a0de78e8dda51cdceffed
SHA1

21ee2e611578a3819715006258e87d5b1aab909e
SHA256

cb61ad6d6b82b6e1c3d29cff7c46bcc85a5077aaa6cee2841f8902790554e33c
SHA512

6839e2e4bfd4224762235c849cadddbb24c0304da682161ba81dc18ab45827d22e05f0bc29df34242b788a664b772c1737062b6a945d99d5930f956fdc618f28
SSDEEP

1536:SZTrrEZFkW/ymMEXrJxxcrYKcF70DAb3/2uCYqElnd:SZXIZFkW/yhENLKcFoDAj2Yq

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4540	c1984d0c871a0de78e8dda51cdceffed.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4540	c1984d0c871a0de78e8dda51cdceffed.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 1728	4540	c1984d0c871a0de78e8dda51cdceffed.exe	91
PID 4540 wrote to memory of 1728	4540	c1984d0c871a0de78e8dda51cdceffed.exe	91
PID 4540 wrote to memory of 1728	4540	c1984d0c871a0de78e8dda51cdceffed.exe	91

C:\Users\Admin\AppData\Local\Temp\c1984d0c871a0de78e8dda51cdceffed.exe
"C:\Users\Admin\AppData\Local\Temp\c1984d0c871a0de78e8dda51cdceffed.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\C1984D~1.EXE
  2⤵
  PID:1728

memory/4540-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4540-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download