6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9

Analysis

max time kernel
26s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 00:33

Target

6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe
Size

3.4MB
MD5

bc68ffee147f13684d09d03a518f1195
SHA1

8c1f32dacfd7dce3189cd91231ca04cef25329a4
SHA256

6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9
SHA512

da84312a9c19714ecfc914fbe58ae6ce8a6d517049daf4f98ef84828af8af1cf64343140721c7393e25e91592664a57a2ceaee7a23e2263391889b137716a689
SSDEEP

24576:3Pt77LMlWAuP1b6a+uuvxIClOg9rc9cHjk9Dw5iTlt8D2eP30AslYttUylozlcDh:3BnfvuTH1WvtIx+ODeyAKGDX

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe

description	pid	process	target process
PID 4260 set thread context of 4812	4260	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe

pid	process
4260	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe
4260	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe

description pid process

Token: SeDebugPrivilege 4260 6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe

description	pid	process
Token: SeDebugPrivilege	4260	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe

description	pid	process	target process
PID 4260 wrote to memory of 4812	4260	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe
PID 4260 wrote to memory of 4812	4260	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe
PID 4260 wrote to memory of 4812	4260	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe
PID 4260 wrote to memory of 4812	4260	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe
PID 4260 wrote to memory of 4812	4260	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe
PID 4260 wrote to memory of 4812	4260	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe
PID 4260 wrote to memory of 4812	4260	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe
PID 4260 wrote to memory of 4812	4260	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe	6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe

C:\Users\Admin\AppData\Local\Temp\6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe
"C:\Users\Admin\AppData\Local\Temp\6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe"
2⤵
PID:4812

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\6e6ca0cfd9a70cf9cca4cdf7c8a559825bc5e6eb6b2633011c30c7fa9f3db8b9.exe.log
Filesize
408B

MD5
04ad5d645afd4aad8257d37d2b197bd9

SHA1
f27458933c22a18ed06c3ef023d9356bae6f5e89

SHA256
519a7b0a515b09c8d149c48a26e782e13decd80c2a2957a751f58801bed026d0

SHA512
34097f7ec87c917ebb2f38a156a33ff1b5f8570141acd666a1fce2cd5d40e464762a3a596a44f078318f92823a7d7b961751c4399040a09e5eddb941f22c4754

Download Submit
memory/4260-132-0x0000000075440000-0x00000000759F1000-memory.dmp

Filesize
5.7MB

Download
memory/4260-136-0x0000000075440000-0x00000000759F1000-memory.dmp

Filesize
5.7MB

Download
memory/4812-134-0x0000000000400000-0x00000000005D0000-memory.dmp

Filesize
1.8MB

Download
memory/4812-137-0x0000000075440000-0x00000000759F1000-memory.dmp

Filesize
5.7MB

Download
memory/4812-133-0x0000000000000000-mapping.dmp

Download