646c54d0a33a2c5b79afae4036991fcdfbc93fdca901b6bb223e4a11ac829c91

Analysis

max time kernel
132s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2022, 16:19

Target
c7d3032e4716d9ad3fcac4c4b0bd2157.exe
Size 549KB
Sample220801-tsg8dsdhdr
SHA256 646c54d0a33a2c5b79afae4036991fcdfbc93fdca901b6bb223e4a11ac829c91
MD5 c7d3032e4716d9ad3fcac4c4b0bd2157
SHA1 77196834745d3cf4813b9d39f85b3a2850505f51
SHA512 13cc1f6d07cbf127fab6b85888b289475c98b0d1fb8e3db48c428571bf10ac37fa2b80303db1b8a33fbbb05b9e682532b721a59bffff7225baef8b4954b4876e
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4900 set thread context of 4772	4900	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4772	c7d3032e4716d9ad3fcac4c4b0bd2157.exe
4772	c7d3032e4716d9ad3fcac4c4b0bd2157.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	c7d3032e4716d9ad3fcac4c4b0bd2157.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4772	4900	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	87
PID 4900 wrote to memory of 4772	4900	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	87
PID 4900 wrote to memory of 4772	4900	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	87
PID 4900 wrote to memory of 4772	4900	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	87
PID 4900 wrote to memory of 4772	4900	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	87
PID 4900 wrote to memory of 4772	4900	c7d3032e4716d9ad3fcac4c4b0bd2157.exe	87

C:\Users\Admin\AppData\Local\Temp\c7d3032e4716d9ad3fcac4c4b0bd2157.exe
"C:\Users\Admin\AppData\Local\Temp\c7d3032e4716d9ad3fcac4c4b0bd2157.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\c7d3032e4716d9ad3fcac4c4b0bd2157.exe
  "C:\Users\Admin\AppData\Local\Temp\c7d3032e4716d9ad3fcac4c4b0bd2157.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772

memory/4772-135-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4772-136-0x0000000000F20000-0x000000000126A000-memory.dmp

Download

memory/4900-132-0x00000000004C0000-0x000000000054E000-memory.dmp

Download

memory/4900-133-0x0000000005DD0000-0x0000000006374000-memory.dmp

Download