ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac

Analysis

max time kernel
180s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 23:51

Target

ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe
Size

167KB
MD5

40d4e7a524fd729431a6602da1d00220
SHA1

db21bdda35a47dd35af84328af8c53b888548f51
SHA256

ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac
SHA512

eab3bd09b23711defdb513a4e7ace4acff6a9869a89ca3e92994907732eb8a1d057760e809e0d46a86c9884bfe531205e16f4a139604fa725b85a5a720ecb326
SSDEEP

3072:dL1XmHqqI8+oRQxvP/iGK1frztO2RbpLmJGU67qWBHgEujXC8LcE:nXmXIrxvP/i9rY0pLm07qWBHgzzcE

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2052 set thread context of 4168	2052	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4168	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe
4168	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 4168	2052	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	83
PID 2052 wrote to memory of 4168	2052	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	83
PID 2052 wrote to memory of 4168	2052	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	83
PID 2052 wrote to memory of 4168	2052	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	83
PID 2052 wrote to memory of 4168	2052	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	83
PID 2052 wrote to memory of 4168	2052	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	83
PID 2052 wrote to memory of 4168	2052	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	83
PID 2052 wrote to memory of 4168	2052	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	83
PID 4168 wrote to memory of 2704	4168	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	76
PID 4168 wrote to memory of 2704	4168	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	76
PID 4168 wrote to memory of 2704	4168	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	76
PID 4168 wrote to memory of 2704	4168	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	76
PID 4168 wrote to memory of 2704	4168	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	76

memory/2052-132-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2052-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4168-134-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4168-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4168-136-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4168-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download