4328098ccec01385575732e4e8d27ca234132d7714801ce75cb343f8b943e806

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 04:21

Target

script_rust.exe
Size

124KB
MD5

4d894c11b710d9fe8de95e01d588692c
SHA1

f6aa2631924bf057fade84729dd98a286d99b61e
SHA256

2b4e72cae6a923a5b1edde1c8bc0e47d25e3506b69a14363295a248c8b05b587
SHA512

c963aaed40e4a7bebe8d0f90eda21a68ab96f9fadad70078b0b7747e9d7106f25ec430e7cf1419ecdafb4caddfd67edf69cfb1a24f231434ba8fb11e689709b9
SSDEEP

3072:YpzMJvf/O6974gOLThlg4JBZzNOcDjGx7h9QEmL9fYzU:uz+f/7gsq1NOcDyxbnmZfCU

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4908	script_rust.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3940	4908	script_rust.exe	84
PID 4908 wrote to memory of 3940	4908	script_rust.exe	84
PID 4908 wrote to memory of 1184	4908	script_rust.exe	85
PID 4908 wrote to memory of 1184	4908	script_rust.exe	85
PID 4908 wrote to memory of 4532	4908	script_rust.exe	86
PID 4908 wrote to memory of 4532	4908	script_rust.exe	86

C:\Users\Admin\AppData\Local\Temp\script_rust.exe
"C:\Users\Admin\AppData\Local\Temp\script_rust.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B5
  2⤵
  PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 16
  2⤵
  PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color DE
  2⤵
  PID:4532