71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 07:30

Target

71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe
Size

292KB
MD5

78d9e9acffcb13f587eb8019fdd58f70
SHA1

16f606d06efd736220c1dd5dd9f705526e8972c4
SHA256

71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98
SHA512

06796e0c2cc98f4994d3293c0fe44a49c5b2ef00d8fe0fa167d13a188b7579ad200ce480d721876c2abb51ec0997bad528e0f359aa39c51d79faf6c7089eb9e7
SSDEEP

6144:9mC2F8NXC796TB9vj48MPja4gL29g13LA9WtSHEfaXVCkRiXq:9geVQkTrvj47P3gLe0XtuXVCkV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 1780	1976	71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1780	1976	71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe	26
PID 1976 wrote to memory of 1780	1976	71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe	26
PID 1976 wrote to memory of 1780	1976	71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe	26
PID 1976 wrote to memory of 1780	1976	71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe	26
PID 1976 wrote to memory of 1780	1976	71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe	26
PID 1976 wrote to memory of 1780	1976	71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe	26
PID 1976 wrote to memory of 1780	1976	71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe	26

C:\Users\Admin\AppData\Local\Temp\71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe
"C:\Users\Admin\AppData\Local\Temp\71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe
  C:\Users\Admin\AppData\Local\Temp\71523e691d2a4741ff7b5366de39b5214e08d35602410edc3e89af29c7416d98.exe
  2⤵
  PID:1780

memory/1780-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1780-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1780-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1780-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1780-74-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1976-54-0x0000000000220000-0x0000000000258000-memory.dmp

Filesize
224KB

Download
memory/1976-63-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1976-64-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/1976-71-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download