b944c2d2b450ec2a2ffce9b121e98dd3123da5209db9a16e2822a9bc0f6dd8bf

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 04:21

Target

931E03D296E920701E86FA698A223CBC.exe
Size

32KB
MD5

931e03d296e920701e86fa698a223cbc
SHA1

7f8876cc0ff72da9edf3faf20493ee865b300ddc
SHA256

b944c2d2b450ec2a2ffce9b121e98dd3123da5209db9a16e2822a9bc0f6dd8bf
SHA512

834ff46277a68b2a55a7536580675e3617bc62b65ea9cf9ace7b7113134937191f3624cdddd7084a580dd929f46bef7e36503cc6e60b95b59a15359229b41091
SSDEEP

384:J0bUe5XB4e0X2O3fw0Q0mS03AWTxtTUFQqzFBObbJ:yT9Bulo55dbbJ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	931E03D296E920701E86FA698A223CBC.exe
Token: 33	2088	931E03D296E920701E86FA698A223CBC.exe
Token: SeIncBasePriorityPrivilege	2088	931E03D296E920701E86FA698A223CBC.exe
Token: 33	2088	931E03D296E920701E86FA698A223CBC.exe
Token: SeIncBasePriorityPrivilege	2088	931E03D296E920701E86FA698A223CBC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2696	2088	931E03D296E920701E86FA698A223CBC.exe	29
PID 2088 wrote to memory of 2696	2088	931E03D296E920701E86FA698A223CBC.exe	29
PID 2088 wrote to memory of 2696	2088	931E03D296E920701E86FA698A223CBC.exe	29
PID 2088 wrote to memory of 2696	2088	931E03D296E920701E86FA698A223CBC.exe	29

C:\Users\Admin\AppData\Local\Temp\931E03D296E920701E86FA698A223CBC.exe
"C:\Users\Admin\AppData\Local\Temp\931E03D296E920701E86FA698A223CBC.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\931E03D296E920701E86FA698A223CBC.exe"
  2⤵
  PID:2696

memory/2088-0-0x00000000741A1000-0x00000000741A2000-memory.dmp

Filesize
4KB

Download
memory/2088-1-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/2088-2-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/2088-3-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/2088-4-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download