d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
Size

1.8MB
MD5

30de43bd389e9ae6b7e063ce8d7ead85
SHA1

05725b240d355a59a73688b10f6bdbc2a4b2a131
SHA256

d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd
SHA512

630c2f4d935c4d83ed0b4c05a6f392b940548d0b8b4b32ad28142b5d33ed56e5f32c9aaed1595df9423322f100cf50c132d624eb97324a32bb47c71a04b3140f
SSDEEP

24576:ZYLYxM2LSDJZn0d25gx8VsMaBgoHDKFDL3qbdbLUHprT3yZNm+APiEW3h7X7dHGN:Xxbo0d25tHeK5YipCSHuBrCvG6

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe

description	pid	process	target process
PID 2028 set thread context of 952	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe

description	pid	process
Token: SeDebugPrivilege	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
Token: 33	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
Token: SeIncBasePriorityPrivilege	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe

description	pid	process	target process
PID 2028 wrote to memory of 952	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
PID 2028 wrote to memory of 952	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
PID 2028 wrote to memory of 952	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
PID 2028 wrote to memory of 952	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
PID 2028 wrote to memory of 952	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
PID 2028 wrote to memory of 952	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
PID 2028 wrote to memory of 952	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
PID 2028 wrote to memory of 952	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
PID 2028 wrote to memory of 952	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
PID 2028 wrote to memory of 952	2028	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe	d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe

C:\Users\Admin\AppData\Local\Temp\d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
"C:\Users\Admin\AppData\Local\Temp\d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
C:\Users\Admin\AppData\Local\Temp\d150fc520ae3f392966c302a07e8a059a1f84fb876d3bfe62ecea5cd73e1c9bd.exe
2⤵
PID:952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-57-0x000000000062119E-mapping.dmp

Download
memory/2028-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x0000000073F20000-0x00000000744CB000-memory.dmp

Filesize
5.7MB

Download
memory/2028-58-0x0000000073F20000-0x00000000744CB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads