4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/12/2024, 00:50

Target

4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe
Size

17KB
MD5

5fc925dccc87a017afdeb282abcd15c0
SHA1

37490c3d629bc7081082aca0422d2c45ed0520d3
SHA256

4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7
SHA512

6ce7ba920269c04ce52b39aae684ed6f70b7bec238c6098e47c64f9fc0a8712a0958faa546a59a207535a8dcd797594f5404a0766a3ce32cb59005e0513571e7
SSDEEP

384:kEGfInKqgn7PiAniAAAeXWLMN8GuTM0sg7UAmm6+5qZMXBNTV76fA:kZfyU76AniAAAdJsCDXBNTpP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe
1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe
1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe
1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe
1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe
1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2344	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe	30
PID 1380 wrote to memory of 2344	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe	30
PID 1380 wrote to memory of 2344	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe	30
PID 1380 wrote to memory of 2344	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe	30
PID 1380 wrote to memory of 2404	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe	31
PID 1380 wrote to memory of 2404	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe	31
PID 1380 wrote to memory of 2404	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe	31
PID 1380 wrote to memory of 2404	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe	31
PID 1380 wrote to memory of 1964	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe	32
PID 1380 wrote to memory of 1964	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe	32
PID 1380 wrote to memory of 1964	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe	32
PID 1380 wrote to memory of 1964	1380	4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe	32

C:\Users\Admin\AppData\Local\Temp\4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe
"C:\Users\Admin\AppData\Local\Temp\4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1964

memory/1380-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download
memory/1380-1-0x000000013F710000-0x000000013F718000-memory.dmp

Filesize
32KB

Download
memory/1380-2-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/1380-3-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download