aecb379bd1a5fd3be43048397e9143660cf038e5a3831564ff2d3258a7551903

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 20:16

Target

1059-7502821dcf68d42012118b9b79f265a5ca5a1212.exe
Size

201KB
MD5

f80379bf6ba3bbc351bfe2f27fa15abb
SHA1

7502821dcf68d42012118b9b79f265a5ca5a1212
SHA256

a35cce4296e9ab78e9d5d6a762c2fabeff1b59fc5f9e006982cdffa753835b97
SHA512

29cff5ee0ba8f6147b30755c035e7dd4d34897e2087b96043b486ebec2bd6933ddb0889ec3c4c0dedb7742ea69751167de7e45144023a2c6e0650d1e696135fd
SSDEEP

3072:kEHlQr71FHBSHIG6mQwGmfOQd8YhY0/EqUG8M8yURta/kN6c42jQ6BeC:ihcd6bUfFdXThUP5yURta/kN6c4Cd

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	1059-7502821dcf68d42012118b9b79f265a5ca5a1212.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1720	552	1059-7502821dcf68d42012118b9b79f265a5ca5a1212.exe	28
PID 552 wrote to memory of 1720	552	1059-7502821dcf68d42012118b9b79f265a5ca5a1212.exe	28
PID 552 wrote to memory of 1720	552	1059-7502821dcf68d42012118b9b79f265a5ca5a1212.exe	28
PID 552 wrote to memory of 1720	552	1059-7502821dcf68d42012118b9b79f265a5ca5a1212.exe	28

C:\Users\Admin\AppData\Local\Temp\1059-7502821dcf68d42012118b9b79f265a5ca5a1212.exe
"C:\Users\Admin\AppData\Local\Temp\1059-7502821dcf68d42012118b9b79f265a5ca5a1212.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 536
  2⤵
  PID:1720

memory/552-0-0x0000000074781000-0x0000000074782000-memory.dmp

Filesize
4KB

Download
memory/552-1-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/552-2-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/552-3-0x0000000000580000-0x0000000000584000-memory.dmp

Filesize
16KB

Download
memory/552-6-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/1720-5-0x0000000001E30000-0x0000000001E31000-memory.dmp

Filesize
4KB

Download