35b4a84324681a1000c14cf114b6f94ada34eb6c6ca38b9a4584b31e742aece3

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 20:42

Target

cc619dc3b71bf6ddf8ab304990a4215b.exe
Size

852KB
MD5

cc619dc3b71bf6ddf8ab304990a4215b
SHA1

9d08d85b6594f112ff6812d667cd835ac81e305a
SHA256

35b4a84324681a1000c14cf114b6f94ada34eb6c6ca38b9a4584b31e742aece3
SHA512

068f6d394c0ac2c5c110209dfb2aba0051536aee3dddc41b7b867cc7b5a69e3cb5b697189ab8b00485969cd396295f4b0fc55347ce6c3f457397d8855850b4ee
SSDEEP

24576:bp/YH7l3kAWXz+EQ9Gak77eZpwQ1EaDSTd:147lkD7iGaWSZId

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	cc619dc3b71bf6ddf8ab304990a4215b.exe
Token: 33	2128	cc619dc3b71bf6ddf8ab304990a4215b.exe
Token: SeIncBasePriorityPrivilege	2128	cc619dc3b71bf6ddf8ab304990a4215b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1832	2128	cc619dc3b71bf6ddf8ab304990a4215b.exe	28
PID 2128 wrote to memory of 1832	2128	cc619dc3b71bf6ddf8ab304990a4215b.exe	28
PID 2128 wrote to memory of 1832	2128	cc619dc3b71bf6ddf8ab304990a4215b.exe	28

C:\Users\Admin\AppData\Local\Temp\cc619dc3b71bf6ddf8ab304990a4215b.exe
"C:\Users\Admin\AppData\Local\Temp\cc619dc3b71bf6ddf8ab304990a4215b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 556
  2⤵
  PID:1832

memory/1832-6-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2128-2-0x0000000001F40000-0x0000000001FC0000-memory.dmp

Filesize
512KB

Download
memory/2128-1-0x0000000001F40000-0x0000000001FC0000-memory.dmp

Filesize
512KB

Download
memory/2128-4-0x0000000001F40000-0x0000000001FC0000-memory.dmp

Filesize
512KB

Download
memory/2128-3-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2128-0-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2128-5-0x0000000001F40000-0x0000000001FC0000-memory.dmp

Filesize
512KB

Download
memory/2128-7-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2128-8-0x0000000001F40000-0x0000000001FC0000-memory.dmp

Filesize
512KB

Download