3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1

Analysis

max time kernel
152s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 13:36

Target

3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe
Size

164KB
MD5

0efc0ade270bfb1a6a92787d3a300bb6
SHA1

5a049fed81c4f9ddcd2049e36f0d1f68c53cdf78
SHA256

3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1
SHA512

0d483e8d1e5a7c073c7f1b5ba4cb3004fa9099fdf07e292e2b9b9c39ae33884c284db1fd2124176e685727f502c4184c92f3ddc622841e0027bbad96518c768a
SSDEEP

3072:x03v7jeagDo0z8VSFcRf5QYMmGHgBJ/OJ8aECov1PnEL2okxfO0BMO:xGWaao0wVjRxPG6dOJI7snUp

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1076	3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe
1076	3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe
1076	3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe
1076	3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe
1076	3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe
1076	3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1124	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe
Token: SeDebugPrivilege	1076	3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe
Token: SeDebugPrivilege	1076	3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1124	1076	3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe	43

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1124
- C:\Users\Admin\AppData\Local\Temp\3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe
  "C:\Users\Admin\AppData\Local\Temp\3b82c864d38c33f6cc49afaa0391bfb462cf21e831a4ff4d8a2a109ba326d0b1.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1076