528fd8741878d288f3664f625c841a6af08d9f34040d60486f51abe55b2f0166

Analysis

max time kernel
69s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 23:48

Target

528fd8741878d288f3664f625c841a6af08d9f34040d60486f51abe55b2f0166.exe
Size

25KB
MD5

760268f563ae0100231ac54bae9800f4
SHA1

25216f84489ebd9917c0f88f622c56d446214ec2
SHA256

528fd8741878d288f3664f625c841a6af08d9f34040d60486f51abe55b2f0166
SHA512

5db5c7756a48ee59cd57e389c7d69b0c2f7fcba48c3c511d396ec2ae8c84c3f43b0cc0d325c3a3fb9a123b501732d322608078ccc8e866470f3641972aa9ca22
SSDEEP

768:JCZnbCdg3rCN5xuGSjvYIvyIJEcrwWAS1mtP9TJ:JCZbU8CN5XigAV/rzm19TJ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1264	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 1264	1112	528fd8741878d288f3664f625c841a6af08d9f34040d60486f51abe55b2f0166.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1112	528fd8741878d288f3664f625c841a6af08d9f34040d60486f51abe55b2f0166.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1264	1112	528fd8741878d288f3664f625c841a6af08d9f34040d60486f51abe55b2f0166.exe	28
PID 1112 wrote to memory of 1264	1112	528fd8741878d288f3664f625c841a6af08d9f34040d60486f51abe55b2f0166.exe	28
PID 1112 wrote to memory of 1264	1112	528fd8741878d288f3664f625c841a6af08d9f34040d60486f51abe55b2f0166.exe	28
PID 1112 wrote to memory of 1264	1112	528fd8741878d288f3664f625c841a6af08d9f34040d60486f51abe55b2f0166.exe	28
PID 1112 wrote to memory of 1264	1112	528fd8741878d288f3664f625c841a6af08d9f34040d60486f51abe55b2f0166.exe	28

C:\Users\Admin\AppData\Local\Temp\528fd8741878d288f3664f625c841a6af08d9f34040d60486f51abe55b2f0166.exe
"C:\Users\Admin\AppData\Local\Temp\528fd8741878d288f3664f625c841a6af08d9f34040d60486f51abe55b2f0166.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:1264

memory/1112-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1112-55-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1112-56-0x0000000001EA0000-0x00000000022A5000-memory.dmp

Filesize
4.0MB

Download