646c54d0a33a2c5b79afae4036991fcdfbc93fdca901b6bb223e4a11ac829c91

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
01/08/2022, 16:19

Target
c7d3032e4716d9ad3fcac4c4b0bd2157.exe
Size 549KB
Sample220801-tsg8dsdhdr
SHA256 646c54d0a33a2c5b79afae4036991fcdfbc93fdca901b6bb223e4a11ac829c91
MD5 c7d3032e4716d9ad3fcac4c4b0bd2157
SHA1 77196834745d3cf4813b9d39f85b3a2850505f51
SHA512 13cc1f6d07cbf127fab6b85888b289475c98b0d1fb8e3db48c428571bf10ac37fa2b80303db1b8a33fbbb05b9e682532b721a59bffff7225baef8b4954b4876e
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1908 set thread context of 2032	1908	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2032	c7d3032e4716d9ad3fcac4c4b0bd2157.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	c7d3032e4716d9ad3fcac4c4b0bd2157.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2032	1908	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	27
PID 1908 wrote to memory of 2032	1908	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	27
PID 1908 wrote to memory of 2032	1908	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	27
PID 1908 wrote to memory of 2032	1908	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	27
PID 1908 wrote to memory of 2032	1908	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	27
PID 1908 wrote to memory of 2032	1908	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	27
PID 1908 wrote to memory of 2032	1908	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	27
PID 1908 wrote to memory of 2032	1908	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	27
PID 1908 wrote to memory of 2032	1908	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	27
PID 1908 wrote to memory of 2032	1908	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	27

C:\Users\Admin\AppData\Local\Temp\c7d3032e4716d9ad3fcac4c4b0bd2157.exe
"C:\Users\Admin\AppData\Local\Temp\c7d3032e4716d9ad3fcac4c4b0bd2157.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\c7d3032e4716d9ad3fcac4c4b0bd2157.exe
  "C:\Users\Admin\AppData\Local\Temp\c7d3032e4716d9ad3fcac4c4b0bd2157.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032

memory/1908-54-0x0000000000A80000-0x0000000000B0E000-memory.dmp

Download

memory/1908-55-0x0000000074DB1000-0x0000000074DB3000-memory.dmp

Download

memory/2032-56-0x0000000000090000-0x00000000000BD000-memory.dmp

Download

memory/2032-57-0x0000000000090000-0x00000000000BD000-memory.dmp

Download

memory/2032-61-0x0000000000090000-0x00000000000BD000-memory.dmp

Download

memory/2032-63-0x0000000000750000-0x0000000000A53000-memory.dmp

Download