2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df

Analysis

max time kernel
4s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 04:28

Target

2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe
Size

684KB
MD5

c8cbc4156a476e2b5ae96aceb38cb6e0
SHA1

643dd6b24841e5719a96cae9f833c5a038619d22
SHA256

2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df
SHA512

0b9b94ef8ad3e2d03870829f024f2c0b1080bc920106bf2ef981865985dcb4986415e367bf690cbe40e19ccca6067f8749706f75f5a863074b7b5dbabafc81ca
SSDEEP

12288:gc//////WLYC667mJ9lvmj7L35ozkARqnrHXcOIXeSQhYBA0KK+pZD/2KshBIqlg:gc//////+ELlu35KYHXcAfhqKNZD2Kso

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe

description	pid	process	target process
PID 2040 set thread context of 1212	2040	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe

description pid process

Token: SeDebugPrivilege 1212 2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe

description	pid	process
Token: SeDebugPrivilege	1212	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe

pid	process
1212	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe
1212	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe
1212	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe

description	pid	process	target process
PID 2040 wrote to memory of 1212	2040	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe
PID 2040 wrote to memory of 1212	2040	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe
PID 2040 wrote to memory of 1212	2040	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe
PID 2040 wrote to memory of 1212	2040	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe
PID 2040 wrote to memory of 1212	2040	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe
PID 2040 wrote to memory of 1212	2040	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe	2100ac479a3688e2dbdc8a06c04d01e3de03698d913f26836d864265c89bc4df.exe

memory/1212-54-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1212-56-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1212-57-0x00000000004647DE-mapping.dmp

Download
memory/1212-59-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1212-60-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1212-61-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1212-62-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download