4328098ccec01385575732e4e8d27ca234132d7714801ce75cb343f8b943e806

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 04:21

Target

script_rust.exe
Size

124KB
MD5

4d894c11b710d9fe8de95e01d588692c
SHA1

f6aa2631924bf057fade84729dd98a286d99b61e
SHA256

2b4e72cae6a923a5b1edde1c8bc0e47d25e3506b69a14363295a248c8b05b587
SHA512

c963aaed40e4a7bebe8d0f90eda21a68ab96f9fadad70078b0b7747e9d7106f25ec430e7cf1419ecdafb4caddfd67edf69cfb1a24f231434ba8fb11e689709b9
SSDEEP

3072:YpzMJvf/O6974gOLThlg4JBZzNOcDjGx7h9QEmL9fYzU:uz+f/7gsq1NOcDyxbnmZfCU

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2212	script_rust.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2656	2212	script_rust.exe	32
PID 2212 wrote to memory of 2656	2212	script_rust.exe	32
PID 2212 wrote to memory of 2656	2212	script_rust.exe	32
PID 2212 wrote to memory of 2688	2212	script_rust.exe	33
PID 2212 wrote to memory of 2688	2212	script_rust.exe	33
PID 2212 wrote to memory of 2688	2212	script_rust.exe	33
PID 2212 wrote to memory of 2696	2212	script_rust.exe	34
PID 2212 wrote to memory of 2696	2212	script_rust.exe	34
PID 2212 wrote to memory of 2696	2212	script_rust.exe	34

C:\Users\Admin\AppData\Local\Temp\script_rust.exe
"C:\Users\Admin\AppData\Local\Temp\script_rust.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B5
  2⤵
  PID:2656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 16
  2⤵
  PID:2688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color DE
  2⤵
  PID:2696