98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24

Analysis

max time kernel
10s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 00:46

Target

98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe
Size

56KB
MD5

3972d3c47913bc3fb3bcd82cc45e2be7
SHA1

ea6424eab14d0a38cb71184a9e10449c5ed205e2
SHA256

98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24
SHA512

95084d043559373cb71f8bf24b410bcc73bf6944b88fb85111c1274327b40035f760fefd063d73286b7c1cfbf33fa0b1fe57e9af3d8a7e59788e8b071305d75e
SSDEEP

1536:Z2SIENFMRsqhE3mCcIOMb0FoRxLZLPVb5Ul:c8wsqGIo3pNb5q

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 936	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1932	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	28
PID 1888 wrote to memory of 1932	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	28
PID 1888 wrote to memory of 1932	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	28
PID 1888 wrote to memory of 1932	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	28
PID 1888 wrote to memory of 936	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	29
PID 1888 wrote to memory of 936	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	29
PID 1888 wrote to memory of 936	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	29
PID 1888 wrote to memory of 936	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	29
PID 1888 wrote to memory of 936	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	29
PID 1888 wrote to memory of 936	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	29
PID 1888 wrote to memory of 936	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	29
PID 1888 wrote to memory of 936	1888	98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe	29

C:\Users\Admin\AppData\Local\Temp\98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe
"C:\Users\Admin\AppData\Local\Temp\98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe
  C:\Users\Admin\AppData\Local\Temp\98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe
  2⤵
  PID:1932
- C:\Users\Admin\AppData\Local\Temp\98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe
  C:\Users\Admin\AppData\Local\Temp\98ae8026299af28e487b4eb4538fb16cbb68027fa991182ef309e80c9f72ca24.exe
  2⤵
  PID:936

memory/936-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/936-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/936-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/936-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1888-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1888-61-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download