7ee312d9045362745f327d6218e113f191d31079e1a162a03b5e2c83d33b56c3

Analysis

max time kernel
73s
max time network
75s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20/05/2024, 19:02

Target

PPPwn GUI 1.3.exe
Size

20.6MB
MD5

3c9ee19a60ef37cade44e9a4531e584d
SHA1

60fc5fd9cb948a8e6774d15328b3338f1bb9fe31
SHA256

7ee312d9045362745f327d6218e113f191d31079e1a162a03b5e2c83d33b56c3
SHA512

d03ce396746129a3e8d60b8f4bb492033344a6bb2f248accc5fd88c8ed89c73eb5789f7e758c247bffff72537e44270950bb78d742cf2368ab84adb72a87b4e3
SSDEEP

393216:ogB1FKVWoF0k6RQvWGCGHracMrDyKON/63/V2gUIWQHS+mKjOAOHe:ogB1MDB6O3CaarU63/YtIpmKjOxe

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
4648	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4264	4780	PPPwn GUI 1.3.exe	74
PID 4780 wrote to memory of 4264	4780	PPPwn GUI 1.3.exe	74
PID 4780 wrote to memory of 4264	4780	PPPwn GUI 1.3.exe	74
PID 4264 wrote to memory of 4648	4264	cmd.exe	76
PID 4264 wrote to memory of 4648	4264	cmd.exe	76
PID 4264 wrote to memory of 4648	4264	cmd.exe	76

C:\Users\Admin\AppData\Local\Temp\PPPwn GUI 1.3.exe
"C:\Users\Admin\AppData\Local\Temp\PPPwn GUI 1.3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C taskkill /IM pppwn_.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM pppwn_.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4648

memory/4780-0-0x0000000073A9E000-0x0000000073A9F000-memory.dmp

Filesize
4KB

Download
memory/4780-1-0x0000000000620000-0x00000000030BE000-memory.dmp

Filesize
42.6MB

Download
memory/4780-2-0x0000000073A90000-0x000000007417E000-memory.dmp

Filesize
6.9MB

Download
memory/4780-3-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download
memory/4780-4-0x0000000007F80000-0x000000000847E000-memory.dmp

Filesize
5.0MB

Download
memory/4780-5-0x0000000007B20000-0x0000000007BB2000-memory.dmp

Filesize
584KB

Download
memory/4780-6-0x0000000008480000-0x0000000008974000-memory.dmp

Filesize
5.0MB

Download
memory/4780-7-0x0000000007B10000-0x0000000007B1A000-memory.dmp

Filesize
40KB

Download
memory/4780-8-0x0000000073A90000-0x000000007417E000-memory.dmp

Filesize
6.9MB

Download
memory/4780-9-0x000000000D4D0000-0x000000000DD32000-memory.dmp

Filesize
8.4MB

Download
memory/4780-10-0x000000000DE40000-0x000000000DF16000-memory.dmp

Filesize
856KB

Download
memory/4780-36-0x0000000073A9E000-0x0000000073A9F000-memory.dmp

Filesize
4KB

Download
memory/4780-37-0x0000000073A90000-0x000000007417E000-memory.dmp

Filesize
6.9MB

Download
memory/4780-38-0x0000000073A90000-0x000000007417E000-memory.dmp

Filesize
6.9MB

Download