a2001892410e9f34ff0d02c8bc9e7c53b0bd10da58461e1e9eab26bdbf410c79

Resubmissions

31/01/2026, 00:30

10/01/2026, 20:09

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
10/01/2026, 20:09

Target
art.exe
Size 1.2MB
Sample260110-yxbcvsd14a
SHA256 a2001892410e9f34ff0d02c8bc9e7c53b0bd10da58461e1e9eab26bdbf410c79
MD5 74e75830252220cbbe7e3adec4340d2d
SHA1 b4f5555d5b934b927de4950131952e17e7194665
SHA512 b49ab0eece316a694c158e6b6958b2d09d0c50dce92baed09c24704c7e7f9804247455e8f9a74e1d9ba309395b88d8c9d4afe832735252d826a2b8eae8da2d9f
SSDEEP 24576:FNfoT3/QPvpFAEkgRk+5gQTAj2FUNu3eLrDSr+AtU5KJL:FNfor/QP3EAB5H8jXuOLrDSr+AtU5KJL
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	whoami.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4884	4672	art.exe	77
PID 4672 wrote to memory of 4216	4672	art.exe	79
PID 4672 wrote to memory of 2524	4672	art.exe	81

C:\Users\Admin\AppData\Local\Temp\art.exe
"C:\Users\Admin\AppData\Local\Temp\art.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\system32\whoami.exe
  "whoami.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4884
- C:\Windows\system32\hostname.exe
  "hostname.exe"
  2⤵
  PID:4216
- C:\Windows\system32\nslookup.exe
  "nslookup.exe" ad
  2⤵
  PID:2524