2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b

Analysis

max time kernel
169s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 18:34

Target

2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe
Size

800KB
MD5

016945e2ea7dabd27551ea79fd7643f0
SHA1

07e3da237bee81ac593b171cee87ab6806128ae4
SHA256

2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b
SHA512

433ae6e459819626ed9b0f9670106c1efa4fef0eef15fd53afadd9993615cf81dac2ed67c70f6c424a59cbf1ca88e51ae2dd7c53f93061b96509ab7482ebe9f1
SSDEEP

12288:bm3QTAh7ZSi2Gbprau0WkWZl3eRkKPodZ3j9eEJIc4GZxHzuC/fh+aI5jw1E276l:mEqYGbprau0WkWZl3eRkKPoHk4uC/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4132 set thread context of 316	4132	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	83

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4132	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe
4132	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe
4132	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 316	4132	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	83
PID 4132 wrote to memory of 316	4132	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	83
PID 4132 wrote to memory of 316	4132	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	83
PID 4132 wrote to memory of 316	4132	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	83
PID 4132 wrote to memory of 316	4132	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	83

C:\Users\Admin\AppData\Local\Temp\2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe
"C:\Users\Admin\AppData\Local\Temp\2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe
  C:\Users\Admin\AppData\Local\Temp\2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe
  2⤵
  PID:316

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe.log

Filesize
1004B

MD5
b57cf43e2eae3770bd168629df0f7800

SHA1
72e72285d439d2bace85c5b2c2d0a8820de08cbe

SHA256
43a90d0025fbfd906d05fff6adc4e47067a4c0a325ec83d4fbb0dd702f659190

SHA512
b314307e1ad10f61b58fae4e521d3562bcd627451726e8fe0f8db50f0a77b5a93512c89eb766b743773b0f26f836d97730596a42361a44190ec4f98534c21019

Download Submit
memory/316-138-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4132-132-0x0000000000920000-0x00000000009EE000-memory.dmp

Filesize
824KB

Download
memory/4132-133-0x0000000005370000-0x000000000540C000-memory.dmp

Filesize
624KB

Download
memory/4132-134-0x00000000059C0000-0x0000000005F64000-memory.dmp

Filesize
5.6MB

Download
memory/4132-135-0x00000000054B0000-0x0000000005542000-memory.dmp

Filesize
584KB

Download
memory/4132-136-0x0000000005450000-0x000000000545A000-memory.dmp

Filesize
40KB

Download