8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591

Analysis

max time kernel
68s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 22:32

Target

8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe
Size

344KB
MD5

84866da712b155de8583f2d9c6c7cb27
SHA1

cd72640042662c3aeb764a9375ffac0ccb2902dd
SHA256

8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591
SHA512

d82b35e1682fdffbf84d19f56f0240026f324696ad43aedc568aa65cac817c69d548dc19b2fa88956527ab798b5e49eceae7bce1f3d007bdf612b323cd31de66
SSDEEP

6144:xW2RCb06IaEabByIJTfy6tpCBpLaHGaqgtrLBmsFMSLGWnWsJ38nKS19Pi:xW20IaEabAKTfya0QGktrEf0WfKk1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1708 set thread context of 872	1708	8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 872	1708	8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe	28
PID 1708 wrote to memory of 872	1708	8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe	28
PID 1708 wrote to memory of 872	1708	8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe	28
PID 1708 wrote to memory of 872	1708	8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe	28
PID 1708 wrote to memory of 872	1708	8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe	28
PID 1708 wrote to memory of 872	1708	8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe	28
PID 1708 wrote to memory of 872	1708	8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe	28
PID 1708 wrote to memory of 872	1708	8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe	28
PID 1708 wrote to memory of 872	1708	8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe	28

C:\Users\Admin\AppData\Local\Temp\8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe
"C:\Users\Admin\AppData\Local\Temp\8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe
  "C:\Users\Admin\AppData\Local\Temp\8ba2a5ccabc2d17336d294a7288fd66375db6694596052ce79a73d5c1923d591.exe"
  2⤵
  PID:872

memory/872-57-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/872-58-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/872-60-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/872-61-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/872-64-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/872-65-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/1708-54-0x0000000075651000-0x0000000075653000-memory.dmp

Filesize
8KB

Download
memory/1708-55-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/1708-56-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/1708-67-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download