e01f501bee178a30f537905b17d8f0afa784607b558d89ec1b59a02f7d87aab3

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2022, 10:29

Target

e01f501bee178a30f537905b17d8f0afa784607b558d89ec1b59a02f7d87aab3.exe
Size

3.0MB
MD5

7137111b12aef7a6e5f49c9edf55f766
SHA1

200dea43803eaf816f0701108c9d20eadd7d2f14
SHA256

e01f501bee178a30f537905b17d8f0afa784607b558d89ec1b59a02f7d87aab3
SHA512

ce21d5da1dc9ea3380b5e622bf9f0199053176aabf5d3a36123ffcee1a94e342d87616e551db985d65d51d061d3e8def489036c396ab489d2c9ef5625ccba6f3
SSDEEP

49152:ZtSS2WNH7PH479RvDBm4qBKTPdWUQN0ifIKFrp14Yl3c:ZtSS2WNH7PY7fvN4gTPdONgKFrp14H

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 101968	2224	e01f501bee178a30f537905b17d8f0afa784607b558d89ec1b59a02f7d87aab3.exe	86

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	101968	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 101968	2224	e01f501bee178a30f537905b17d8f0afa784607b558d89ec1b59a02f7d87aab3.exe	86
PID 2224 wrote to memory of 101968	2224	e01f501bee178a30f537905b17d8f0afa784607b558d89ec1b59a02f7d87aab3.exe	86
PID 2224 wrote to memory of 101968	2224	e01f501bee178a30f537905b17d8f0afa784607b558d89ec1b59a02f7d87aab3.exe	86
PID 2224 wrote to memory of 101968	2224	e01f501bee178a30f537905b17d8f0afa784607b558d89ec1b59a02f7d87aab3.exe	86
PID 2224 wrote to memory of 101968	2224	e01f501bee178a30f537905b17d8f0afa784607b558d89ec1b59a02f7d87aab3.exe	86

C:\Users\Admin\AppData\Local\Temp\e01f501bee178a30f537905b17d8f0afa784607b558d89ec1b59a02f7d87aab3.exe
"C:\Users\Admin\AppData\Local\Temp\e01f501bee178a30f537905b17d8f0afa784607b558d89ec1b59a02f7d87aab3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:101968

memory/101968-133-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/101968-138-0x0000000005160000-0x00000000051C6000-memory.dmp

Filesize
408KB

Download