8cc02a93a6ec92e0bf059ee4e7dc879cff73a03419673078d774fbe3eaa19139

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 13:50

Target

xvONQE15fXnp.exe
Size

32KB
MD5

2bc6e494ad1dffc7fa6e818dd8a57f16
SHA1

37c9c6924b2175b465011b5ebaa383f624709fb2
SHA256

8cc02a93a6ec92e0bf059ee4e7dc879cff73a03419673078d774fbe3eaa19139
SHA512

e1b9525c21ede9e8610b64a3610d481b5e27df3233638e6e81beca99505119b0aee968d6d8bfd3de9b1ff5438157f6e004add5b97f596c016da3d0994fba680a
SSDEEP

384:u0bUe5XB4e0XrOnaiaXLilpknDEWTUtTUFQqz9eObb0:/T9BuSpaXWlt0b0

Score

1^/10

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1424	xvONQE15fXnp.exe
Token: 33	1424	xvONQE15fXnp.exe
Token: SeIncBasePriorityPrivilege	1424	xvONQE15fXnp.exe
Token: 33	1424	xvONQE15fXnp.exe
Token: SeIncBasePriorityPrivilege	1424	xvONQE15fXnp.exe
Token: 33	1424	xvONQE15fXnp.exe
Token: SeIncBasePriorityPrivilege	1424	xvONQE15fXnp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 4092	1424	xvONQE15fXnp.exe	97
PID 1424 wrote to memory of 4092	1424	xvONQE15fXnp.exe	97
PID 1424 wrote to memory of 4092	1424	xvONQE15fXnp.exe	97

C:\Users\Admin\AppData\Local\Temp\xvONQE15fXnp.exe
"C:\Users\Admin\AppData\Local\Temp\xvONQE15fXnp.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\xvONQE15fXnp.exe"
  2⤵
  PID:4092

memory/1424-0-0x00000000749A0000-0x0000000074F51000-memory.dmp

Filesize
5.7MB

Download
memory/1424-1-0x00000000749A0000-0x0000000074F51000-memory.dmp

Filesize
5.7MB

Download
memory/1424-2-0x0000000001450000-0x0000000001460000-memory.dmp

Filesize
64KB

Download
memory/1424-3-0x00000000749A0000-0x0000000074F51000-memory.dmp

Filesize
5.7MB

Download
memory/1424-4-0x00000000749A0000-0x0000000074F51000-memory.dmp

Filesize
5.7MB

Download
memory/1424-5-0x0000000001450000-0x0000000001460000-memory.dmp

Filesize
64KB

Download
memory/1424-7-0x00000000749A0000-0x0000000074F51000-memory.dmp

Filesize
5.7MB

Download