37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d

Analysis

max time kernel
155s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:48

Target

37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe
Size

141KB
MD5

f707bbac715d9589520b85a956998fcf
SHA1

657e884d65f9084f73897e7d392019096fa6e795
SHA256

37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d
SHA512

7622f75ef15afbd66be0d8f0b60c88c4f798708c1aed2187aea56ad193dd0444dd2b13d356268fd57e578ccb4c084e747bb7261245b65ae5157428b2450ddbf2
SSDEEP

3072:3N7Gw2n0nPBm/hIY3AdFxLrPvSySMiXfn0TI:3NJ2/hIY3MMdfn0M

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe

description	pid	process	target process
PID 3460 set thread context of 2680	3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe

pid	process
3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe
3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe
3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe
3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe

description	pid	process
Token: 33	3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe
Token: SeIncBasePriorityPrivilege	3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe

description	pid	process	target process
PID 3460 wrote to memory of 2680	3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe
PID 3460 wrote to memory of 2680	3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe
PID 3460 wrote to memory of 2680	3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe
PID 3460 wrote to memory of 2680	3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe
PID 3460 wrote to memory of 2680	3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe
PID 3460 wrote to memory of 2680	3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe
PID 3460 wrote to memory of 2680	3460	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe	37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe

C:\Users\Admin\AppData\Local\Temp\37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe
"C:\Users\Admin\AppData\Local\Temp\37cb2dc660505585c1c4dba2e2cd0add26456a369b0728034278076ec6db029d.exe"
2⤵
PID:2680

memory/2680-132-0x0000000000000000-mapping.dmp

Download
memory/2680-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download