756ca5eff4ddb4d5eca111e88703484ee54bdb716f28368f860a9dd6964d6a4b

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 12:34

Target
virus/xmrig-6.21.3/benchmark_10M.cmd
Size 61B
Sample240525-prtgtabf66
SHA256 235a64e3520b1c2c27763122b303f78aee8d7c083dfd9f1eb936cd5174383609
MD5 5be1c4cacb5ae37c43527e99a097dc7a
SHA1 1b2f00fefde9d601764d5d26d5e0fb2b9f58074c
SHA512 20a9e18bc397fe86514875af4213a02a5831a27671370849f05c2f3ba048bc29fc41ca96f0cb1cc08aaff27bbebf637f30d2ee798cb80ed03080e8c7d8f2d9a1
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	544	xmrig.exe
Token: SeLockMemoryPrivilege	544	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
544	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 544	2988	cmd.exe	29
PID 2988 wrote to memory of 544	2988	cmd.exe	29
PID 2988 wrote to memory of 544	2988	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\virus\xmrig-6.21.3\benchmark_10M.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\virus\xmrig-6.21.3\xmrig.exe
  xmrig.exe --bench=10M --submit
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:544

memory/544-0-0x0000000000080000-0x00000000000A0000-memory.dmp

Download

memory/544-2-0x0000000002160000-0x0000000002180000-memory.dmp

Download

memory/544-1-0x0000000002140000-0x0000000002160000-memory.dmp

Download