ed76506699f017e58204ac9e1e326c00e0d233055cfb81d75185a286aa2e4491

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 14:52

Target

c62830b448d961b104ad3c5fd3e6d9d2.exe
Size

1.0MB
MD5

c62830b448d961b104ad3c5fd3e6d9d2
SHA1

4fcc4791b7b4a4345d7539b97ae319f067eea4fc
SHA256

ed76506699f017e58204ac9e1e326c00e0d233055cfb81d75185a286aa2e4491
SHA512

59b67513078a299d3984d2b85de38626e56f721f4ad68e475323a9bb497476a9227d41199fd843f1b69d35de9d6aafed73f9ccdf99208814f578933615da0196
SSDEEP

3072:RoSr2csOirEfXntXU09Uj30f937isGJJLHNf:Wvcs38XnlU0K30f9KJJ7

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	c62830b448d961b104ad3c5fd3e6d9d2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1852	1380	c62830b448d961b104ad3c5fd3e6d9d2.exe	89
PID 1380 wrote to memory of 1852	1380	c62830b448d961b104ad3c5fd3e6d9d2.exe	89
PID 1380 wrote to memory of 1852	1380	c62830b448d961b104ad3c5fd3e6d9d2.exe	89

C:\Users\Admin\AppData\Local\Temp\c62830b448d961b104ad3c5fd3e6d9d2.exe
"C:\Users\Admin\AppData\Local\Temp\c62830b448d961b104ad3c5fd3e6d9d2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\arp.exe
  "C:\Windows\System32\arp.exe" -a
  2⤵
  PID:1852

memory/1380-0-0x00000000008A0000-0x00000000009B2000-memory.dmp

Filesize
1.1MB

Download
memory/1380-1-0x0000000074F30000-0x00000000756E0000-memory.dmp

Filesize
7.7MB

Download
memory/1380-2-0x0000000005970000-0x0000000005F14000-memory.dmp

Filesize
5.6MB

Download
memory/1380-3-0x00000000053C0000-0x0000000005452000-memory.dmp

Filesize
584KB

Download
memory/1380-4-0x0000000005340000-0x0000000005350000-memory.dmp

Filesize
64KB

Download
memory/1380-5-0x0000000074F30000-0x00000000756E0000-memory.dmp

Filesize
7.7MB

Download