5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52

General

Target

5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe
Size

504KB
MD5

708a1af68d532df35c34f7088b8e798f
SHA1

d140c6cc6929db8666f4b6b2c8734c013755a514
SHA256

5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52
SHA512

58de1a121a32ab41ead7e8ebc1f1e7c133d85e3ae3cdcd60832115068c0357690b3dcd0f66c2f73381b33bdd6ea633cf2c7a2be72491845df6619c4a3a2c291d

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1920	1640	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1640	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
632	dw20.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1920	1640	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	27
PID 1640 wrote to memory of 1920	1640	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	27
PID 1640 wrote to memory of 1920	1640	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	27
PID 1640 wrote to memory of 1920	1640	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	27
PID 1640 wrote to memory of 1920	1640	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	27
PID 1640 wrote to memory of 1920	1640	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	27
PID 1640 wrote to memory of 1920	1640	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	27
PID 1640 wrote to memory of 1920	1640	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	27
PID 1640 wrote to memory of 1920	1640	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	27
PID 1920 wrote to memory of 632	1920	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	29
PID 1920 wrote to memory of 632	1920	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	29
PID 1920 wrote to memory of 632	1920	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	29
PID 1920 wrote to memory of 632	1920	5c1f7c4ebf49ebcc1e07309d90049ffcc47a83318ae041330e777ad9a3befc52.exe	29

memory/632-64-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/1640-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1640-55-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/1920-56-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1920-57-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1920-58-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1920-60-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1920-62-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download