0f2be1e974ae7ee9be5354fbef333e105cce5c25473648e66a67269d560220f4

Analysis

max time kernel
131s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 15:08

Target
bUHF.exe
Size 32KB
Sample240424-shv6tscb35
SHA256 0f2be1e974ae7ee9be5354fbef333e105cce5c25473648e66a67269d560220f4
MD5 b47307545c821c03b617776a41df1741
SHA1 086f735fcd95e8d3608e22494ae3cadd4d9d7acb
SHA512 3393fd1e427430e5ac3a8d40bef45bd26d0490d9184d4cbddb595efa1c6fc5ede427962d93c18710d554472c93d6e4dc42bb4c7bb6e987c305b9c43c3a0d2209
SSDEEP 384:z0bUe5XB4e0XvOxZggUBZIGlWT1tTUFQqzFBObbB:gT9BumzggUBZI5XbB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4896	bUHF.exe
Token: 33	4896	bUHF.exe
Token: SeIncBasePriorityPrivilege	4896	bUHF.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 2320	4896	bUHF.exe	96
PID 4896 wrote to memory of 2320	4896	bUHF.exe	96
PID 4896 wrote to memory of 2320	4896	bUHF.exe	96

C:\Users\Admin\AppData\Local\Temp\bUHF.exe
"C:\Users\Admin\AppData\Local\Temp\bUHF.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\bUHF.exe"
  2⤵
  PID:2320

memory/4896-0-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/4896-1-0x0000000001220000-0x0000000001230000-memory.dmp

Download

memory/4896-2-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/4896-3-0x0000000001220000-0x0000000001230000-memory.dmp

Download

memory/4896-5-0x0000000074670000-0x0000000074C21000-memory.dmp

Download