ca610938fbce79e1b39d0be34db05b71515c803ee347251f202df9c09dbc3ff4

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 03:32

Target

cz-x1/start.cmd
Size

44B
MD5

eaf3a00cc0465f8af471b849ada29843
SHA1

3042e97874706189aa9704d77c9e74a94e519106
SHA256

8e70ef38fe14a2ee2848df3d6f7e260d1caf8cfc15de694d678b8af151d62333
SHA512

56b9f3991ae4bad5e06097d095931e746e6b2ac955649a5c793d9f4f6861c6ffc9316b063c34d7a8079af201354c87bf3008bc0fd4321e59b27e1d8120b078cf

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3864	xmrig.exe
Token: SeLockMemoryPrivilege	3864	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3864	xmrig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 3864	400	cmd.exe	85
PID 400 wrote to memory of 3864	400	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cz-x1\start.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Local\Temp\cz-x1\xmrig.exe
  xmrig.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3864

memory/3864-0-0x000001823E5A0000-0x000001823E5C0000-memory.dmp

Filesize
128KB

Download
memory/3864-2-0x00000182D0740000-0x00000182D0760000-memory.dmp

Filesize
128KB

Download
memory/3864-3-0x00000182D0B80000-0x00000182D0BA0000-memory.dmp

Filesize
128KB

Download
memory/3864-4-0x00000182D0DB0000-0x00000182D0DD0000-memory.dmp

Filesize
128KB

Download
memory/3864-5-0x00000182D0B80000-0x00000182D0BA0000-memory.dmp

Filesize
128KB

Download
memory/3864-6-0x00000182D0DB0000-0x00000182D0DD0000-memory.dmp

Filesize
128KB

Download