b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 12:19

Target

b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b.exe
Size

128KB
MD5

642f39b3b1c7e865dcd71e51c09d7e33
SHA1

13f746bf7a0bcaf3943a90d250fd6ada07783428
SHA256

b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b
SHA512

bcf737ccd7e230c237c1db3fe88bcb29c0db75b28ffb3fcd43fc644574e9e6469116b4b71f6dfa3604452358b0823a5fce345fc7ee3ae2d6207256a9eeb1495e
SSDEEP

3072:3ewvFTjuyu6dj2J67lgOSz+9xNYuQbB/F0zW7qnYEwg91l80L80FY3FguRXG:Dvxa8dS6eOSz+HNYX90zWcH91jLKFgu8

Score

7^/10

Deletes itself 1 IoCs

pid	Process
940	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 940	900	b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
900	b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b.exe
900	b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 940	900	b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b.exe	27
PID 900 wrote to memory of 940	900	b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b.exe	27
PID 900 wrote to memory of 940	900	b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b.exe	27
PID 900 wrote to memory of 940	900	b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b.exe	27
PID 900 wrote to memory of 940	900	b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b.exe	27

C:\Users\Admin\AppData\Local\Temp\b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b.exe
"C:\Users\Admin\AppData\Local\Temp\b15b366b8d23c85fe788b438eaff6a2950aefd06ca250d976e5b646d7c6cce5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:940

memory/900-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/900-55-0x0000000000230000-0x0000000000237000-memory.dmp

Filesize
28KB

Download
memory/900-56-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/900-57-0x0000000000270000-0x000000000028F000-memory.dmp

Filesize
124KB

Download
memory/900-61-0x0000000000270000-0x000000000028F000-memory.dmp

Filesize
124KB

Download
memory/900-65-0x0000000000270000-0x000000000028F000-memory.dmp

Filesize
124KB

Download
memory/900-66-0x00000000003D0000-0x00000000003ED000-memory.dmp

Filesize
116KB

Download