4fc089dfeb2d2197d951123cb0bf0fca8fc4660621db9590ef0c83234bccdef8

Analysis

Target
31e105135a4901bd485731c281d93842.exe
Size 424KB
Sample220708-slqerafdal
SHA256 4fc089dfeb2d2197d951123cb0bf0fca8fc4660621db9590ef0c83234bccdef8
MD5 31e105135a4901bd485731c281d93842
SHA1 a776a442d84d40543273cf15c6e8d3a350437b17
SHA512 26f6b6ed03a7a0c564291ceed76a6ce42ad45fb1ab7d8bbe69cd6a100c0669928391b4d08327ad777a54be7e7f22de1054a6ca0651c25a2ebe0f4660d6d49cdb
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 340	1688	31e105135a4901bd485731c281d93842.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
340	31e105135a4901bd485731c281d93842.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	31e105135a4901bd485731c281d93842.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 340	1688	31e105135a4901bd485731c281d93842.exe	27
PID 1688 wrote to memory of 340	1688	31e105135a4901bd485731c281d93842.exe	27
PID 1688 wrote to memory of 340	1688	31e105135a4901bd485731c281d93842.exe	27
PID 1688 wrote to memory of 340	1688	31e105135a4901bd485731c281d93842.exe	27
PID 1688 wrote to memory of 340	1688	31e105135a4901bd485731c281d93842.exe	27
PID 1688 wrote to memory of 340	1688	31e105135a4901bd485731c281d93842.exe	27
PID 1688 wrote to memory of 340	1688	31e105135a4901bd485731c281d93842.exe	27
PID 1688 wrote to memory of 340	1688	31e105135a4901bd485731c281d93842.exe	27
PID 1688 wrote to memory of 340	1688	31e105135a4901bd485731c281d93842.exe	27
PID 1688 wrote to memory of 340	1688	31e105135a4901bd485731c281d93842.exe	27

C:\Users\Admin\AppData\Local\Temp\31e105135a4901bd485731c281d93842.exe
"C:\Users\Admin\AppData\Local\Temp\31e105135a4901bd485731c281d93842.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\31e105135a4901bd485731c281d93842.exe
  "C:\Users\Admin\AppData\Local\Temp\31e105135a4901bd485731c281d93842.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:340

memory/340-56-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/340-57-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/340-59-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/340-62-0x0000000002590000-0x0000000002893000-memory.dmp

Download

memory/1688-54-0x0000000076391000-0x0000000076393000-memory.dmp

Download

memory/1688-55-0x0000000001120000-0x0000000001190000-memory.dmp

Download