89b4067a98c617d7d81350f7b5f5e7d5c2530a766cd42c7d1cb46efac3e9d7ae

General

Target

2dcb0750dd72d9be99b1f0d42b20b673.exe
Size

1.2MB
MD5

2dcb0750dd72d9be99b1f0d42b20b673
SHA1

db0ae37505432923aa6e00ce404212216e6f3121
SHA256

89b4067a98c617d7d81350f7b5f5e7d5c2530a766cd42c7d1cb46efac3e9d7ae
SHA512

66c0e6f194d77c3645b1007438d1f457f127d43771efd9c6617123adc9b0bc561599bc3feaa406033600545fca8d723489e5da8f4abc70722eb1383f43b8da0a

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

2dcb0750dd72d9be99b1f0d42b20b673.exe

description pid process target process

PID 500 set thread context of 2696 500 2dcb0750dd72d9be99b1f0d42b20b673.exe 2dcb0750dd72d9be99b1f0d42b20b673.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2dcb0750dd72d9be99b1f0d42b20b673.exe

pid process

500 2dcb0750dd72d9be99b1f0d42b20b673.exe
500 2dcb0750dd72d9be99b1f0d42b20b673.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2dcb0750dd72d9be99b1f0d42b20b673.exe

description pid process

Token: SeDebugPrivilege 500 2dcb0750dd72d9be99b1f0d42b20b673.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2dcb0750dd72d9be99b1f0d42b20b673.exe

pid process

2696 2dcb0750dd72d9be99b1f0d42b20b673.exe

description	pid	process	target process
PID 500 set thread context of 2696	500	2dcb0750dd72d9be99b1f0d42b20b673.exe	2dcb0750dd72d9be99b1f0d42b20b673.exe

pid	process
500	2dcb0750dd72d9be99b1f0d42b20b673.exe
500	2dcb0750dd72d9be99b1f0d42b20b673.exe

description	pid	process
Token: SeDebugPrivilege	500	2dcb0750dd72d9be99b1f0d42b20b673.exe

pid	process
2696	2dcb0750dd72d9be99b1f0d42b20b673.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

2dcb0750dd72d9be99b1f0d42b20b673.exe

description	pid	process	target process
PID 500 wrote to memory of 2680	500	2dcb0750dd72d9be99b1f0d42b20b673.exe	2dcb0750dd72d9be99b1f0d42b20b673.exe
PID 500 wrote to memory of 2680	500	2dcb0750dd72d9be99b1f0d42b20b673.exe	2dcb0750dd72d9be99b1f0d42b20b673.exe
PID 500 wrote to memory of 2680	500	2dcb0750dd72d9be99b1f0d42b20b673.exe	2dcb0750dd72d9be99b1f0d42b20b673.exe
PID 500 wrote to memory of 2696	500	2dcb0750dd72d9be99b1f0d42b20b673.exe	2dcb0750dd72d9be99b1f0d42b20b673.exe
PID 500 wrote to memory of 2696	500	2dcb0750dd72d9be99b1f0d42b20b673.exe	2dcb0750dd72d9be99b1f0d42b20b673.exe
PID 500 wrote to memory of 2696	500	2dcb0750dd72d9be99b1f0d42b20b673.exe	2dcb0750dd72d9be99b1f0d42b20b673.exe
PID 500 wrote to memory of 2696	500	2dcb0750dd72d9be99b1f0d42b20b673.exe	2dcb0750dd72d9be99b1f0d42b20b673.exe
PID 500 wrote to memory of 2696	500	2dcb0750dd72d9be99b1f0d42b20b673.exe	2dcb0750dd72d9be99b1f0d42b20b673.exe
PID 500 wrote to memory of 2696	500	2dcb0750dd72d9be99b1f0d42b20b673.exe	2dcb0750dd72d9be99b1f0d42b20b673.exe
PID 500 wrote to memory of 2696	500	2dcb0750dd72d9be99b1f0d42b20b673.exe	2dcb0750dd72d9be99b1f0d42b20b673.exe
PID 500 wrote to memory of 2696	500	2dcb0750dd72d9be99b1f0d42b20b673.exe	2dcb0750dd72d9be99b1f0d42b20b673.exe

C:\Users\Admin\AppData\Local\Temp\2dcb0750dd72d9be99b1f0d42b20b673.exe
"C:\Users\Admin\AppData\Local\Temp\2dcb0750dd72d9be99b1f0d42b20b673.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:500
- C:\Users\Admin\AppData\Local\Temp\2dcb0750dd72d9be99b1f0d42b20b673.exe
  "C:\Users\Admin\AppData\Local\Temp\2dcb0750dd72d9be99b1f0d42b20b673.exe"
  2⤵
  PID:2680
- C:\Users\Admin\AppData\Local\Temp\2dcb0750dd72d9be99b1f0d42b20b673.exe
  "C:\Users\Admin\AppData\Local\Temp\2dcb0750dd72d9be99b1f0d42b20b673.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2696

memory/500-114-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/500-116-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/500-117-0x0000000005330000-0x0000000005331000-memory.dmp

Filesize
4KB

Download
memory/500-118-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/500-119-0x0000000002880000-0x0000000002881000-memory.dmp

Filesize
4KB

Download
memory/500-120-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/500-121-0x0000000002880000-0x000000000291C000-memory.dmp

Filesize
624KB

Download
memory/500-122-0x0000000006830000-0x000000000684B000-memory.dmp

Filesize
108KB

Download
memory/500-123-0x00000000085B0000-0x0000000008642000-memory.dmp

Filesize
584KB

Download
memory/500-124-0x0000000008690000-0x00000000086DF000-memory.dmp

Filesize
316KB

Download
memory/2696-126-0x00000000004025AC-mapping.dmp

Download
memory/2696-125-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download