d88a3e728153a059a398e01b451767e0fccf2eba9dcfeb6a5fe014363984a1c0

Analysis

max time kernel
95s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 19:10

Target
bUBD.exe
Size 32KB
Sample240417-xve3labc45
SHA256 d88a3e728153a059a398e01b451767e0fccf2eba9dcfeb6a5fe014363984a1c0
MD5 b0eb1186dec29582d7c86d211e2addf8
SHA1 f8edefa10e35a0434bcb56ba45fcc265b4da6c52
SHA512 d3152ab2ebb76eea8ef99627317e4d9c01aa0cd060089338e6d62fbbc9d374ea282338c111100b430d11aeeb1faa73b973c4ff3473d6c2a66805c453e7fe3421
SSDEEP 384:e0bUe5XB4e0X0gONpQq1pvmufCsIs6WT2tTUFQqz9A+ObbE:PT9Bui/Qqvvmu6V/bE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4984	bUBD.exe
Token: 33	4984	bUBD.exe
Token: SeIncBasePriorityPrivilege	4984	bUBD.exe
Token: 33	4984	bUBD.exe
Token: SeIncBasePriorityPrivilege	4984	bUBD.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3596	4984	bUBD.exe	92
PID 4984 wrote to memory of 3596	4984	bUBD.exe	92
PID 4984 wrote to memory of 3596	4984	bUBD.exe	92

C:\Users\Admin\AppData\Local\Temp\bUBD.exe
"C:\Users\Admin\AppData\Local\Temp\bUBD.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\bUBD.exe"
  2⤵
  PID:3596

memory/4984-0-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/4984-1-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/4984-2-0x0000000001470000-0x0000000001480000-memory.dmp

Download

memory/4984-3-0x0000000001470000-0x0000000001480000-memory.dmp

Download

memory/4984-4-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/4984-6-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download