81c18c346ad57ff5c4dc07fe51b0e9411704cb9df362aefd6d6275f6f9660d47

Analysis

max time kernel
140s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 18:09

Target
bUPt.exe
Size 32KB
Sample240503-wref8ace3z
SHA256 81c18c346ad57ff5c4dc07fe51b0e9411704cb9df362aefd6d6275f6f9660d47
MD5 b0f3ca4450a2f669b927ae1517dac1e7
SHA1 7390d9dcd74c4c40f536c8f490f0ba1580523c77
SHA512 de72099a2b301b683534a163a4b3c918a035d1f2f2e25c714e5133b3ad3a62b201b14a200b3459cfa19ae339ec9035eaedd26be27fd70fe1db5b11e84b7ca936
SSDEEP 384:O0bUe5XB4e0XvObfixBr/QdWTStTUFQqzFqObbm:fT9BumTifrYfkbm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	bUPt.exe
Token: 33	1100	bUPt.exe
Token: SeIncBasePriorityPrivilege	1100	bUPt.exe
Token: 33	1100	bUPt.exe
Token: SeIncBasePriorityPrivilege	1100	bUPt.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2092	1100	bUPt.exe	97
PID 1100 wrote to memory of 2092	1100	bUPt.exe	97
PID 1100 wrote to memory of 2092	1100	bUPt.exe	97

C:\Users\Admin\AppData\Local\Temp\bUPt.exe
"C:\Users\Admin\AppData\Local\Temp\bUPt.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\bUPt.exe"
  2⤵
  PID:2092

memory/1100-0-0x0000000074B32000-0x0000000074B33000-memory.dmp

Download

memory/1100-1-0x0000000074B30000-0x00000000750E1000-memory.dmp

Download

memory/1100-2-0x0000000074B30000-0x00000000750E1000-memory.dmp

Download

memory/1100-3-0x0000000074B30000-0x00000000750E1000-memory.dmp

Download

memory/1100-4-0x0000000074B32000-0x0000000074B33000-memory.dmp

Download

memory/1100-6-0x0000000074B30000-0x00000000750E1000-memory.dmp

Download