ed76506699f017e58204ac9e1e326c00e0d233055cfb81d75185a286aa2e4491

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 14:52

Target

c62830b448d961b104ad3c5fd3e6d9d2.exe
Size

1.0MB
MD5

c62830b448d961b104ad3c5fd3e6d9d2
SHA1

4fcc4791b7b4a4345d7539b97ae319f067eea4fc
SHA256

ed76506699f017e58204ac9e1e326c00e0d233055cfb81d75185a286aa2e4491
SHA512

59b67513078a299d3984d2b85de38626e56f721f4ad68e475323a9bb497476a9227d41199fd843f1b69d35de9d6aafed73f9ccdf99208814f578933615da0196
SSDEEP

3072:RoSr2csOirEfXntXU09Uj30f937isGJJLHNf:Wvcs38XnlU0K30f9KJJ7

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3064	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe	28
PID 2948 wrote to memory of 3064	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe	28
PID 2948 wrote to memory of 3064	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe	28
PID 2948 wrote to memory of 3064	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe	28
PID 2948 wrote to memory of 2676	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe	30
PID 2948 wrote to memory of 2676	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe	30
PID 2948 wrote to memory of 2676	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe	30
PID 2948 wrote to memory of 2676	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe	30
PID 2948 wrote to memory of 2892	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe	32
PID 2948 wrote to memory of 2892	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe	32
PID 2948 wrote to memory of 2892	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe	32
PID 2948 wrote to memory of 2892	2948	c62830b448d961b104ad3c5fd3e6d9d2.exe	32

C:\Users\Admin\AppData\Local\Temp\c62830b448d961b104ad3c5fd3e6d9d2.exe
"C:\Users\Admin\AppData\Local\Temp\c62830b448d961b104ad3c5fd3e6d9d2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\arp.exe
  "C:\Windows\System32\arp.exe" -a
  2⤵
  PID:3064
- C:\Windows\SysWOW64\arp.exe
  "C:\Windows\System32\arp.exe" -a
  2⤵
  PID:2676
- C:\Windows\SysWOW64\arp.exe
  "C:\Windows\System32\arp.exe" -a
  2⤵
  PID:2892

memory/2948-0-0x0000000000E60000-0x0000000000F72000-memory.dmp

Filesize
1.1MB

Download
memory/2948-1-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/2948-2-0x0000000004B10000-0x0000000004B50000-memory.dmp

Filesize
256KB

Download
memory/2948-3-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download