a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770

Analysis

max time kernel
32s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 04:13

Target

a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe
Size

55KB
MD5

cf615fda7bab3c866ddff38840f3c43d
SHA1

1a914b9020b6e83047d721d0e6a537de2fd8bd68
SHA256

a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770
SHA512

3e44acc44a9cf38dc8faf928d24c9b6df61b8f6594933f3be057770fed51c5daeeb694415238bf006aa45356b7e601148a9f44656dd3d7b9a7438257bfb3d5a5
SSDEEP

1536:05QAEeWPJ3PM86TSGbaggXJpgq9pskuG1EPRyhYw0mj:0KAEeUJfM8OSGbaggYwWc1EPAhYw0mj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1576 set thread context of 1028	1576	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1028	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe
1028	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1028	1576	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	27
PID 1576 wrote to memory of 1028	1576	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	27
PID 1576 wrote to memory of 1028	1576	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	27
PID 1576 wrote to memory of 1028	1576	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	27
PID 1576 wrote to memory of 1028	1576	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	27
PID 1576 wrote to memory of 1028	1576	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	27
PID 1576 wrote to memory of 1028	1576	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	27
PID 1576 wrote to memory of 1028	1576	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	27
PID 1028 wrote to memory of 1236	1028	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	14
PID 1028 wrote to memory of 1236	1028	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	14
PID 1028 wrote to memory of 1236	1028	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	14
PID 1028 wrote to memory of 1236	1028	a2d43134e83be8dd699c36850ca2f7b16debe852459d8bfb1a5151c14f886770.exe	14

memory/1028-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1028-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1028-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1028-65-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1028-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1236-62-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1576-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1576-59-0x0000000074170000-0x000000007471B000-memory.dmp

Filesize
5.7MB

Download