28ef89083d52e8916cb488dbc75c97e525203f1ba4d13db0cce719af7f446d9d

Analysis

Target

28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe
Size

279KB
MD5

5ecbb6958a0457be1858c6e07d345bf0
SHA1

4ae501af50c2936ecc2801b7e735459b438a5405
SHA256

28ef89083d52e8916cb488dbc75c97e525203f1ba4d13db0cce719af7f446d9d
SHA512

723d3a9f19eac5013a2a529ddc3ad428095c30da6394eb50da264eab2109b3d42e885d00e416b82e89f2a2679a4a292a22a627d796de994ed268983bbe26f439

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe

description	pid	process	target process
PID 3728 set thread context of 4036	3728	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe

description pid process

Token: SeDebugPrivilege 3728 28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe

description	pid	process
Token: SeDebugPrivilege	3728	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe

description	pid	process	target process
PID 3728 wrote to memory of 4036	3728	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe
PID 3728 wrote to memory of 4036	3728	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe
PID 3728 wrote to memory of 4036	3728	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe
PID 3728 wrote to memory of 4036	3728	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe
PID 3728 wrote to memory of 4036	3728	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe
PID 3728 wrote to memory of 4036	3728	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe
PID 3728 wrote to memory of 4036	3728	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe
PID 3728 wrote to memory of 4036	3728	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe
PID 3728 wrote to memory of 4036	3728	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe	28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe

C:\Users\Admin\AppData\Local\Temp\28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe
"C:\Users\Admin\AppData\Local\Temp\28EF89083D52E8916CB488DBC75C97E525203F1BA4D13.exe"
2⤵
PID:4036

memory/3728-115-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3728-117-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/3728-118-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/3728-119-0x0000000000CA0000-0x0000000000CAB000-memory.dmp

Filesize
44KB

Download
memory/3728-120-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/3728-121-0x0000000004C50000-0x000000000514E000-memory.dmp

Filesize
5.0MB

Download
memory/3728-122-0x0000000007450000-0x0000000007451000-memory.dmp

Filesize
4KB

Download
memory/4036-124-0x00000000004139DE-mapping.dmp

Download