1a4d9a79fb19da1782dbfc2b72b883f9414039b893c172859aef7ebf5696de44

Analysis

max time kernel
224s
max time network
283s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 06:47

Target

xmrig-6.21.2/benchmark_1M.cmd
Size

60B
MD5

cba1927cf6959dc99ecbd0c553e4db6f
SHA1

7f2d59cfdf2b0550d22ac54d0b1fa5ac8f8b5f57
SHA256

d7747e7a3c782009f4ceb6e9c106115876386853929563b509da5258e3968d15
SHA512

c78ab9b017153c497ef2d0f568ade265ae9b60238ebdb36d8ef7ecc4d232cd90fd5fdc5b600bb26437466c7300e571b95b4ff92a7f024a981a02196a14d6e3f1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4484	xmrig.exe
Token: SeLockMemoryPrivilege	4484	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4484	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 4484	3016	cmd.exe	85
PID 3016 wrote to memory of 4484	3016	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.2\benchmark_1M.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.2\xmrig.exe
  xmrig.exe --bench=1M --submit
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4484

memory/4484-0-0x000001A121E10000-0x000001A121E30000-memory.dmp

Filesize
128KB

Download
memory/4484-1-0x000001A1B3E90000-0x000001A1B3EB0000-memory.dmp

Filesize
128KB

Download
memory/4484-2-0x000001A1B43D0000-0x000001A1B43F0000-memory.dmp

Filesize
128KB

Download
memory/4484-3-0x000001A1B4600000-0x000001A1B4620000-memory.dmp

Filesize
128KB

Download
memory/4484-5-0x000001A1B4600000-0x000001A1B4620000-memory.dmp

Filesize
128KB

Download
memory/4484-4-0x000001A1B43D0000-0x000001A1B43F0000-memory.dmp

Filesize
128KB

Download