b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 16:26

Target

b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe
Size

43KB
MD5

907e5f7c80ba43fa70127960cb26eb9f
SHA1

057d37e7824cdc54031e39ef85c87cf980acca7e
SHA256

b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03
SHA512

c9c80131031bb42efc9659c8b78a78b0ba9c0222dd30d6408caefd415bc2095d7ffe7428ee353f30a169490ba7d9e0e37cf4bae852a5818ed8777e3dda062804
SSDEEP

768:OEOqmGEbq+lqziQ74S8ZsbfOlLWHbCSOoE+1:OEcq2qzxPRbfSa7C21

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1380 set thread context of 2044	1380	b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2044	1380	b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe	27
PID 1380 wrote to memory of 2044	1380	b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe	27
PID 1380 wrote to memory of 2044	1380	b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe	27
PID 1380 wrote to memory of 2044	1380	b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe	27
PID 1380 wrote to memory of 2044	1380	b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe	27
PID 1380 wrote to memory of 2044	1380	b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe	27
PID 1380 wrote to memory of 2044	1380	b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe	27
PID 1380 wrote to memory of 2044	1380	b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe	27
PID 1380 wrote to memory of 2044	1380	b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe	27

C:\Users\Admin\AppData\Local\Temp\b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe
"C:\Users\Admin\AppData\Local\Temp\b9f181de1d3f32f2cf76c8b74fb696754fc70067432a257c71ae9039cfd38d03.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\Rundll32.exe
  C:\Windows\System32\Rundll32.exe
  2⤵
  PID:2044

memory/1380-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2044-54-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2044-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download