5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d

Analysis

max time kernel
74s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 07:41

Target

5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe
Size

373KB
MD5

68b362b3aaf57159dea10be3b3334c20
SHA1

1df684e6e414302cde7548374baddfa626e61115
SHA256

5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d
SHA512

6c46834d148f2ad2447dcd75e08571cbdba54c247dd148ebabaed4ff06c0450c69e18093d44694ddb95ccad67a26397fd3eca764acf7e565e819a20c1b8198b0
SSDEEP

6144:ENC2F8NXC796TB9vj48+3vHCbbvwRYa4amQWu9Km0JwY7MC58L5fKBUigJfkkC:EHeVQkTrvj4jKXvwRYBNuYm0JZ7Ma8Lu

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2276 set thread context of 620	2276	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe	78

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
620	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe
620	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe
620	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe
620	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 620	2276	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe	78
PID 2276 wrote to memory of 620	2276	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe	78
PID 2276 wrote to memory of 620	2276	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe	78
PID 2276 wrote to memory of 620	2276	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe	78
PID 2276 wrote to memory of 620	2276	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe	78
PID 2276 wrote to memory of 620	2276	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe	78
PID 620 wrote to memory of 3056	620	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe	45
PID 620 wrote to memory of 3056	620	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe	45
PID 620 wrote to memory of 3056	620	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe	45
PID 620 wrote to memory of 3056	620	5d9a3170de8564e11bdc297bd9ceec4c7f66b20da3759251a58e6156fded528d.exe	45

memory/620-136-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/620-139-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/620-142-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2276-132-0x00000000001C0000-0x0000000000200000-memory.dmp

Filesize
256KB

Download
memory/2276-138-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/2276-140-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/3056-141-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download