26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2

Analysis

max time kernel
136s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 14:59

Target

26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe
Size

179KB
MD5

61dd3d5eb836e36cb671d0ff9a37f968
SHA1

871dc08fa21f33c4f7c36acc4f43e0f4ea43ad58
SHA256

26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2
SHA512

972038815670ff19a36c0702e1b0ec2fef5c0a2d5c9ce7afc8a20ff0ac16ba302ae579b38211bb9ad2fc40c6494d2c9110ceb3495032f61e9aa4b9c83251f786
SSDEEP

3072:19qhuqPmRi/FQYsmaCCRKOnUTohVZwJYIrYOr4pcoKI5OJtgAUrtQ:191JRQCOaMMpcbJODr+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 436 set thread context of 3360	436	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe
Token: 33	436	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe
Token: SeIncBasePriorityPrivilege	436	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 3360	436	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	81
PID 436 wrote to memory of 3360	436	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	81
PID 436 wrote to memory of 3360	436	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	81
PID 436 wrote to memory of 3360	436	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	81
PID 436 wrote to memory of 3360	436	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	81
PID 436 wrote to memory of 3360	436	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	81
PID 436 wrote to memory of 3360	436	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	81
PID 3360 wrote to memory of 376	3360	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	55
PID 3360 wrote to memory of 376	3360	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	55
PID 3360 wrote to memory of 376	3360	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	55
PID 3360 wrote to memory of 376	3360	26dc2521047c8f7e09a8e947539d96e76720484f5476f4480363e4921a4cfbc2.exe	55

memory/376-139-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/436-132-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/436-137-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/3360-134-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3360-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3360-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3360-140-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download