e0ce4cebcc945bc3116cf4ea230d32c41060fec1de131ed1b90845d5fbe715e6

Analysis

max time kernel
234s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 09:25

Target

5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe
Size

117KB
MD5

20036b34de52fcee1fd30bdf69e21ef9
SHA1

b06de1d2e41ddd9bc63781ef8447088adf1f9275
SHA256

5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2
SHA512

6b353b4ac767da60bd4e1952480f81bcacdc07a87daa3849abe00b507a83fd05f675bb1b288fbe1ff02b0f8c14456e2764ba1c84078fbaa89504abccaf41c6ee
SSDEEP

3072:yGZUDfQSuSs9GY3YtpJnJGiuMcDUztJLtKnod:j6DfQSuSs9TYGj3Uh

Score

1^/10

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	4424	svchost.exe
Token: SeRestorePrivilege	4424	svchost.exe
Token: SeSecurityPrivilege	4424	svchost.exe
Token: SeTakeOwnershipPrivilege	4424	svchost.exe
Token: 35	4424	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 3784	4596	5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe	91
PID 4596 wrote to memory of 3784	4596	5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe	91
PID 4596 wrote to memory of 3784	4596	5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe	91
PID 2616 wrote to memory of 1616	2616	5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe	104
PID 2616 wrote to memory of 1616	2616	5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe	104
PID 2616 wrote to memory of 1616	2616	5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe	104
PID 3336 wrote to memory of 5044	3336	5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe	106
PID 3336 wrote to memory of 5044	3336	5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe	106
PID 3336 wrote to memory of 5044	3336	5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe	106
PID 3856 wrote to memory of 4236	3856	5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe	108
PID 3856 wrote to memory of 4236	3856	5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe	108
PID 3856 wrote to memory of 4236	3856	5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe	108

C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe
"C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe
  C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe -deleter
  2⤵
  PID:3784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5084

C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe
"C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe
  C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe -deleter
  2⤵
  PID:1616

C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe
"C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe
  C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe -deleter
  2⤵
  PID:5044

C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe
"C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe
  C:\Users\Admin\AppData\Local\Temp\5ae722f53f61bd6de28821b0c8498cdec9f743714616bb41d600eb3fd549f2f2.exe -deleter
  2⤵
  PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4424