49e0b3dd4c0b710ad0574352db2b2c46610bec86a02d9abc3f981d583f3acadf

Resubmissions

02/06/2024, 09:49

02/06/2024, 09:48

max time kernel
145s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
02/06/2024, 09:49

Target

processlasso_portable_64/start-governor.bat
Size

198B
MD5

9b6fe9d42daeb73f0046683dbda5419f
SHA1

a156465564cfe85095a015ea025ec6a51f3bbea1
SHA256

f55cbb14479b25356f55bf0a1a0a669490d1e3da539eb05e84666111c2ed45a5
SHA512

d026c3a25141a5e15e0d8f281d13731d1dd07dfb69c76d60e2d35b4ba900e9697894fdf535a4c4bad792e0c3d39e3e35632b740cfa5af5b34d06aae537f87448

Score

1^/10

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	3128	ProcessGovernor.exe
Token: SeDebugPrivilege	3128	ProcessGovernor.exe
Token: SeChangeNotifyPrivilege	3128	ProcessGovernor.exe
Token: SeIncBasePriorityPrivilege	3128	ProcessGovernor.exe
Token: SeIncreaseQuotaPrivilege	3128	ProcessGovernor.exe
Token: SeProfSingleProcessPrivilege	3128	ProcessGovernor.exe
Token: SeCreateGlobalPrivilege	3128	ProcessGovernor.exe
Token: SeBackupPrivilege	3128	ProcessGovernor.exe
Token: SeRestorePrivilege	3128	ProcessGovernor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 336	2164	cmd.exe	78
PID 2164 wrote to memory of 336	2164	cmd.exe	78
PID 336 wrote to memory of 4228	336	net.exe	79
PID 336 wrote to memory of 4228	336	net.exe	79
PID 2164 wrote to memory of 3128	2164	cmd.exe	80
PID 2164 wrote to memory of 3128	2164	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\processlasso_portable_64\start-governor.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\system32\net.exe
  net start ProcessGovernor
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start ProcessGovernor
    3⤵
    PID:4228
- C:\Users\Admin\AppData\Local\Temp\processlasso_portable_64\ProcessGovernor.exe
  ProcessGovernor.exe /manual
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3128