b01757aae7403720665ae43b35c52f1fce63ffab0fbdfb6d0b5607ac3146c353

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 13:34

Target

b01757aae7403720665ae43b35c52f1fce63ffab0fbdfb6d0b5607ac3146c353.exe
Size

8.9MB
MD5

019faa5f2dd35472ac5731d748d70ccd
SHA1

50af010e633fe337b434d7a3ad5a096b21d226a0
SHA256

b01757aae7403720665ae43b35c52f1fce63ffab0fbdfb6d0b5607ac3146c353
SHA512

6932c5d62044b364585064886d70a7cd04092cce4fb5b313031ae71aaaf1f58a6fd03a97005153a00d5a7704d38cad706c0e1e8ec2e5b8e410830f6b52aac5ae
SSDEEP

49152:YDa3FP2Jrb/TovO90d7HjmAFd4A64nsfJsYEjz6ftEvZlU3O2OqSWiQ+25q6RHNQ:gsdWtw2zo6dsWoEL+AXn0n

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	b01757aae7403720665ae43b35c52f1fce63ffab0fbdfb6d0b5607ac3146c353.exe
Token: SeDebugPrivilege	1612	b01757aae7403720665ae43b35c52f1fce63ffab0fbdfb6d0b5607ac3146c353.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1612	1532	b01757aae7403720665ae43b35c52f1fce63ffab0fbdfb6d0b5607ac3146c353.exe	29
PID 1532 wrote to memory of 1612	1532	b01757aae7403720665ae43b35c52f1fce63ffab0fbdfb6d0b5607ac3146c353.exe	29
PID 1532 wrote to memory of 1612	1532	b01757aae7403720665ae43b35c52f1fce63ffab0fbdfb6d0b5607ac3146c353.exe	29

C:\Users\Admin\AppData\Local\Temp\b01757aae7403720665ae43b35c52f1fce63ffab0fbdfb6d0b5607ac3146c353.exe
"C:\Users\Admin\AppData\Local\Temp\b01757aae7403720665ae43b35c52f1fce63ffab0fbdfb6d0b5607ac3146c353.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Local\Temp\b01757aae7403720665ae43b35c52f1fce63ffab0fbdfb6d0b5607ac3146c353.exe
  C:\Users\Admin\AppData\Local\Temp\b01757aae7403720665ae43b35c52f1fce63ffab0fbdfb6d0b5607ac3146c353.exe 71df7dd7
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1612

memory/1532-0-0x000000013F8A0000-0x00000001401F2000-memory.dmp

Filesize
9.3MB

Download
memory/1612-1-0x000000013F8A0000-0x00000001401F2000-memory.dmp

Filesize
9.3MB

Download
memory/1612-3-0x000000013F8A0000-0x00000001401F2000-memory.dmp

Filesize
9.3MB

Download
memory/1612-5-0x000000013F8A0000-0x00000001401F2000-memory.dmp

Filesize
9.3MB

Download
memory/1612-7-0x000000013F8A0000-0x00000001401F2000-memory.dmp

Filesize
9.3MB

Download
memory/1612-8-0x000000013F8A0000-0x00000001401F2000-memory.dmp

Filesize
9.3MB

Download
memory/1612-10-0x000000013F8A0000-0x00000001401F2000-memory.dmp

Filesize
9.3MB

Download
memory/1612-12-0x000000013F8A0000-0x00000001401F2000-memory.dmp

Filesize
9.3MB

Download