26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2

Analysis

max time kernel
24s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 14:59

Target

26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe
Size

179KB
MD5

61dd3d5eb836e36cb671d0ff9a37f968
SHA1

871dc08fa21f33c4f7c36acc4f43e0f4ea43ad58
SHA256

26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2
SHA512

972038815670ff19a36c0702e1b0ec2fef5c0a2d5c9ce7afc8a20ff0ac16ba302ae579b38211bb9ad2fc40c6494d2c9110ceb3495032f61e9aa4b9c83251f786
SSDEEP

3072:19qhuqPmRi/FQYsmaCCRKOnUTohVZwJYIrYOr4pcoKI5OJtgAUrtQ:191JRQCOaMMpcbJODr+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1368 set thread context of 1612	1368	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1612	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe
1612	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe
Token: 33	1368	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe
Token: SeIncBasePriorityPrivilege	1368	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1612	1368	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	28
PID 1368 wrote to memory of 1612	1368	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	28
PID 1368 wrote to memory of 1612	1368	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	28
PID 1368 wrote to memory of 1612	1368	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	28
PID 1368 wrote to memory of 1612	1368	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	28
PID 1368 wrote to memory of 1612	1368	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	28
PID 1368 wrote to memory of 1612	1368	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	28
PID 1368 wrote to memory of 1612	1368	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	28
PID 1612 wrote to memory of 1224	1612	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	9
PID 1612 wrote to memory of 1224	1612	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	9
PID 1612 wrote to memory of 1224	1612	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	9
PID 1612 wrote to memory of 1224	1612	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	9

memory/1224-62-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1368-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1368-59-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1612-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-65-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download