00a78edf157a3c87ad4b115c94882b77e110d51bd2bd4f59c41781b83620ed7e

Analysis

Target
9e86553502db6aa8fcac5588f517a748.exe
Size 452KB
Sample220119-k4gassgfbl
SHA256 00a78edf157a3c87ad4b115c94882b77e110d51bd2bd4f59c41781b83620ed7e
MD5 9e86553502db6aa8fcac5588f517a748
SHA1 c9515ad9fac7a3fdd7b0e0e84f84d819e35e36eb
SHA512 a0ba009e96e32c3c4d762bea8fafd75cb166adbfdb1d8223494890670efdf7a5f99d1ac1de93547f7778a7b54b02077d25cdd47bb6177e586214ae099077811e
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3396 set thread context of 1328	3396	9e86553502db6aa8fcac5588f517a748.exe	58

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3396	9e86553502db6aa8fcac5588f517a748.exe
3396	9e86553502db6aa8fcac5588f517a748.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3396	9e86553502db6aa8fcac5588f517a748.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 3460	3396	9e86553502db6aa8fcac5588f517a748.exe	57
PID 3396 wrote to memory of 3460	3396	9e86553502db6aa8fcac5588f517a748.exe	57
PID 3396 wrote to memory of 3460	3396	9e86553502db6aa8fcac5588f517a748.exe	57
PID 3396 wrote to memory of 1328	3396	9e86553502db6aa8fcac5588f517a748.exe	58
PID 3396 wrote to memory of 1328	3396	9e86553502db6aa8fcac5588f517a748.exe	58
PID 3396 wrote to memory of 1328	3396	9e86553502db6aa8fcac5588f517a748.exe	58
PID 3396 wrote to memory of 1328	3396	9e86553502db6aa8fcac5588f517a748.exe	58
PID 3396 wrote to memory of 1328	3396	9e86553502db6aa8fcac5588f517a748.exe	58
PID 3396 wrote to memory of 1328	3396	9e86553502db6aa8fcac5588f517a748.exe	58

C:\Users\Admin\AppData\Local\Temp\9e86553502db6aa8fcac5588f517a748.exe
"C:\Users\Admin\AppData\Local\Temp\9e86553502db6aa8fcac5588f517a748.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Temp\9e86553502db6aa8fcac5588f517a748.exe
  "C:\Users\Admin\AppData\Local\Temp\9e86553502db6aa8fcac5588f517a748.exe"
  2⤵
  PID:3460
- C:\Users\Admin\AppData\Local\Temp\9e86553502db6aa8fcac5588f517a748.exe
  "C:\Users\Admin\AppData\Local\Temp\9e86553502db6aa8fcac5588f517a748.exe"
  2⤵
  PID:1328

memory/1328-136-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3396-130-0x0000000000ED0000-0x0000000000F44000-memory.dmp

Download

memory/3396-131-0x0000000005FD0000-0x0000000006574000-memory.dmp

Download

memory/3396-132-0x0000000005950000-0x00000000059E2000-memory.dmp

Download

memory/3396-133-0x0000000005A20000-0x0000000005FC4000-memory.dmp

Download

memory/3396-134-0x0000000005900000-0x000000000590A000-memory.dmp

Download

memory/3396-135-0x0000000007B20000-0x0000000007BBC000-memory.dmp

Download