116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115

Analysis

max time kernel
132s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 18:46

Target

116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe
Size

12KB
MD5

73a82f11b119b3b68161c385d3b21ce1
SHA1

3022ea9d1fb93fba84ae31bfcd843c48baaa89a2
SHA256

116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115
SHA512

fa2f67642930dc534360d0c5ab8294d7bfef22dd9332e72d74017130c0cb26ae25b5b0dd528d9d545e440ddaa4a9f61392d13189168978a10394aaadbe20a2cb
SSDEEP

192:RFBkm/S1R0XLQeFwUxifpoVGxcMR8DdkTYfJMULz9MQ1d:NB/HblJ0+Vq3uaoyA9M

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
396	116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe
Token: SeDebugPrivilege	4780	116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 4780	396	116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe	83
PID 396 wrote to memory of 4780	396	116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe	83
PID 396 wrote to memory of 4780	396	116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe	83

C:\Users\Admin\AppData\Local\Temp\116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe
"C:\Users\Admin\AppData\Local\Temp\116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396
- C:\ProgramData\pcdfdata\116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe
  C:\ProgramData\pcdfdata\116a8e65db201fd329ac14402254202e47314e0f310788948368e75dc9580115.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4780

memory/396-0-0x00000000009A0000-0x00000000009A7000-memory.dmp

Filesize
28KB

Download