68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2

Analysis

max time kernel
113s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 08:17

Target

68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe
Size

103KB
MD5

e324470374d130c5f497e3419880977a
SHA1

bb8b205cddb2dd55ecf6fdcae633bb8baf87b54b
SHA256

68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2
SHA512

fc52c5d40a27768f991457010e618cc004f29fe9fcadc2c91349a0a08690c53efa88bfa59d055c5ed15c03d39c2b26c512a7411f2b5b9da52f6ad9a5a3a1e731
SSDEEP

3072:5qt/NGGYMfhTWWxiLjNT3C6uW5SGnq+ENLOUpx:5qtoXShTWn+aPy

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4824 set thread context of 4108	4824	68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4108	4824	68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe	81
PID 4824 wrote to memory of 4108	4824	68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe	81
PID 4824 wrote to memory of 4108	4824	68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe	81
PID 4824 wrote to memory of 4108	4824	68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe	81
PID 4824 wrote to memory of 4108	4824	68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe	81
PID 4824 wrote to memory of 4108	4824	68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe	81
PID 4824 wrote to memory of 4108	4824	68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe	81

C:\Users\Admin\AppData\Local\Temp\68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe
"C:\Users\Admin\AppData\Local\Temp\68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe
  C:\Users\Admin\AppData\Local\Temp\68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe
  2⤵
  PID:4108

memory/4108-134-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4108-137-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4108-138-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4824-132-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download
memory/4824-136-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download