11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274

Analysis

max time kernel
140s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 17:03

Target

11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe
Size

260KB
MD5

824febe81ffbb702ebf588e180664cca
SHA1

ee3b888e03640d232395f407edbc0f342330fbcd
SHA256

11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274
SHA512

de85f91a793bdb27ec867cbd94aaf57a981419d9951b073728bc5553e4822486c2864572cb15d6ca09143486ff397aeab3697b05917dd9f17ddbce3b01142422
SSDEEP

6144:83K05ZZczJoWiU9I/j2/GNB4bsUMI/5MafLfmjG:YZcepiGNB4P/5MafLfm

Score

8^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/784-58-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/784-60-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/784-61-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/784-66-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/784-67-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/784-68-0x0000000000400000-0x0000000000430000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 288 set thread context of 784	288	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe	28

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	288	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe
Token: SeShutdownPrivilege	784	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe
Token: SeDebugPrivilege	784	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe
Token: SeTcbPrivilege	784	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 784	288	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe	28
PID 288 wrote to memory of 784	288	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe	28
PID 288 wrote to memory of 784	288	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe	28
PID 288 wrote to memory of 784	288	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe	28
PID 288 wrote to memory of 784	288	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe	28
PID 288 wrote to memory of 784	288	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe	28
PID 288 wrote to memory of 784	288	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe	28
PID 288 wrote to memory of 784	288	11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe	28

C:\Users\Admin\AppData\Local\Temp\11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe
"C:\Users\Admin\AppData\Local\Temp\11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:288
- C:\Users\Admin\AppData\Local\Temp\11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe
  "C:\Users\Admin\AppData\Local\Temp\11c0da15857e4601dc790cd5571d6c471d9ea7c1c8ae14f6a5e1ed33d8ec9274.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:784

memory/288-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/288-55-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/288-56-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/288-65-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/784-57-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/784-58-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/784-60-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/784-61-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/784-66-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/784-67-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/784-68-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download