7ee312d9045362745f327d6218e113f191d31079e1a162a03b5e2c83d33b56c3

Analysis

max time kernel
137s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 19:02

Target

PPPwn GUI 1.3.exe
Size

20.6MB
MD5

3c9ee19a60ef37cade44e9a4531e584d
SHA1

60fc5fd9cb948a8e6774d15328b3338f1bb9fe31
SHA256

7ee312d9045362745f327d6218e113f191d31079e1a162a03b5e2c83d33b56c3
SHA512

d03ce396746129a3e8d60b8f4bb492033344a6bb2f248accc5fd88c8ed89c73eb5789f7e758c247bffff72537e44270950bb78d742cf2368ab84adb72a87b4e3
SSDEEP

393216:ogB1FKVWoF0k6RQvWGCGHracMrDyKON/63/V2gUIWQHS+mKjOAOHe:ogB1MDB6O3CaarU63/YtIpmKjOxe

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
5032	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5196 wrote to memory of 5816	5196	PPPwn GUI 1.3.exe	96
PID 5196 wrote to memory of 5816	5196	PPPwn GUI 1.3.exe	96
PID 5196 wrote to memory of 5816	5196	PPPwn GUI 1.3.exe	96
PID 5816 wrote to memory of 5032	5816	cmd.exe	98
PID 5816 wrote to memory of 5032	5816	cmd.exe	98
PID 5816 wrote to memory of 5032	5816	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\PPPwn GUI 1.3.exe
"C:\Users\Admin\AppData\Local\Temp\PPPwn GUI 1.3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C taskkill /IM pppwn_.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM pppwn_.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5032

memory/5196-0-0x00000000750DE000-0x00000000750DF000-memory.dmp

Filesize
4KB

Download
memory/5196-1-0x0000000000B50000-0x00000000035EE000-memory.dmp

Filesize
42.6MB

Download
memory/5196-2-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/5196-3-0x00000000750DE000-0x00000000750DF000-memory.dmp

Filesize
4KB

Download
memory/5196-4-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/5196-5-0x0000000004030000-0x0000000004031000-memory.dmp

Filesize
4KB

Download
memory/5196-6-0x00000000086C0000-0x0000000008C64000-memory.dmp

Filesize
5.6MB

Download
memory/5196-7-0x00000000081F0000-0x0000000008282000-memory.dmp

Filesize
584KB

Download
memory/5196-8-0x0000000008C70000-0x0000000009164000-memory.dmp

Filesize
5.0MB

Download
memory/5196-9-0x00000000083F0000-0x00000000083FA000-memory.dmp

Filesize
40KB

Download
memory/5196-10-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/5196-11-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/5196-12-0x000000000BDC0000-0x000000000C622000-memory.dmp

Filesize
8.4MB

Download
memory/5196-13-0x000000000C7B0000-0x000000000C936000-memory.dmp

Filesize
1.5MB

Download
memory/5196-39-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download