bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 20:56

Target

bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe
Size

641KB
MD5

bd21b3a94164bd92ab510a486546b927
SHA1

500d691b127512183761ebc62cc3362e5a53ba0d
SHA256

bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683
SHA512

682955d0d668b61581928e78016f6dc133ea280e74da77d973ace918320eedb07b5dbac9e2ce30f678b50da3826e33190193bfb39d21ee567d26b7a2d61dc191
SSDEEP

12288:wmMG9IuqGVUrOFDpEw+LOcBBkpwTWnLUlRFTxo4yD9ENQ5xVkA1FbeZn:wmMjuFCAUOcBBrWnLUlmOOP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2496 set thread context of 5072	2496	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 5072	2496	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	80
PID 2496 wrote to memory of 5072	2496	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	80
PID 2496 wrote to memory of 5072	2496	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	80
PID 2496 wrote to memory of 5072	2496	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	80
PID 2496 wrote to memory of 5072	2496	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	80
PID 2496 wrote to memory of 5072	2496	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	80
PID 2496 wrote to memory of 5072	2496	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	80
PID 2496 wrote to memory of 5072	2496	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	80
PID 2496 wrote to memory of 5072	2496	bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe	80

C:\Users\Admin\AppData\Local\Temp\bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe
"C:\Users\Admin\AppData\Local\Temp\bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe
  "C:\Users\Admin\AppData\Local\Temp\bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5072

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bc054ec29440a47a93d51234be633426440647fd188be9e1ee33004a8051d683.exe.log

Filesize
507B

MD5
0e10735cdb58a9ba2f91767066b999dd

SHA1
c50fb05afc5d08050acba48d6b17984c5bd08656

SHA256
c5f9edc79919f40486803529b14876d5273b3fe3956c6ae492c208998ed9b389

SHA512
9337327893c0e6a1b66425349b5b3d3f559d1abf6624e73792aef6e8c2613dc315163055ad7e8fdc22d33a97f3f57751716f91ac65d893949390eaf004028d9f

Download Submit
memory/2496-132-0x0000000000E40000-0x0000000000EE6000-memory.dmp

Filesize
664KB

Download
memory/2496-133-0x00000000058C0000-0x000000000595C000-memory.dmp

Filesize
624KB

Download
memory/2496-134-0x0000000005960000-0x00000000059F2000-memory.dmp

Filesize
584KB

Download
memory/2496-135-0x0000000006100000-0x00000000066A4000-memory.dmp

Filesize
5.6MB

Download
memory/5072-136-0x0000000000000000-mapping.dmp

Download
memory/5072-137-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/5072-138-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/5072-140-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/5072-139-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/5072-143-0x0000000005770000-0x000000000577A000-memory.dmp

Filesize
40KB

Download