762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5

Analysis

max time kernel
141s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 23:39

Target

762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe
Size

60KB
MD5

f6a323ae7505c125e206d4a47c35a2b6
SHA1

e4eac6912121362c4b2859605d2ec27b8523a9b5
SHA256

762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5
SHA512

8cb287f5cb5e0a07831a3dd0f239db7656acf95c98dc3a40e89cd464955886a12dbcf9515fd13c708448b8f9998091f527a7ba03abc04ee41d76829494dd193c
SSDEEP

1536:/INN3t3j82R95giCg/GncQDY4Y7oZ+vx7Z:/Iv9jHv5SJcQDY4byN

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

4324 svchost.exe

pid	process
4324	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe

description	pid	process	target process
PID 516 set thread context of 4324	516	762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe

description pid process

Token: SeDebugPrivilege 516 762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe

description	pid	process
Token: SeDebugPrivilege	516	762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe

description	pid	process	target process
PID 516 wrote to memory of 4324	516	762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe	svchost.exe
PID 516 wrote to memory of 4324	516	762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe	svchost.exe
PID 516 wrote to memory of 4324	516	762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe	svchost.exe
PID 516 wrote to memory of 4324	516	762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe	svchost.exe
PID 516 wrote to memory of 4324	516	762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe	svchost.exe
PID 516 wrote to memory of 4324	516	762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe	svchost.exe
PID 516 wrote to memory of 4324	516	762b168ed170aad51d8330f3a857b08ce7a26e71769ab666e37acecfee75ecf5.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
2⤵
- Executes dropped EXE
PID:4324

C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
2KB

MD5
8580ea7b49506027630d1852be0da5ec

SHA1
49bd0ac6d7aa27568956b9917a5af3acde8ac22a

SHA256
c8b67336101446073d0b38027d85da9712b9d8f3866a4f6cea92eaac06bdd89d

SHA512
356eb05a2d346240f2f660961081b973eb0b218de1718697f758bcca2b7e976e5f71467da5f4cacfdf649120e1fc3e2529a842d3e12b8c7dbd96c3b5ae65faa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
2KB

MD5
8580ea7b49506027630d1852be0da5ec

SHA1
49bd0ac6d7aa27568956b9917a5af3acde8ac22a

SHA256
c8b67336101446073d0b38027d85da9712b9d8f3866a4f6cea92eaac06bdd89d

SHA512
356eb05a2d346240f2f660961081b973eb0b218de1718697f758bcca2b7e976e5f71467da5f4cacfdf649120e1fc3e2529a842d3e12b8c7dbd96c3b5ae65faa2

Download Submit
memory/516-132-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Filesize
5.7MB

Download
memory/516-133-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Filesize
5.7MB

Download
memory/516-138-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Filesize
5.7MB

Download
memory/4324-134-0x0000000000000000-mapping.dmp

Download
memory/4324-135-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download