a018512a0ee9522b4e73aabd573e54d0ec194ad28371a654f1ef751e4dd1be88

Analysis

max time kernel
13s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 00:20

Target

TEMP~1.exe
Size

235KB
MD5

69388e97f03b1c4f6bbcd6cdc21d8df7
SHA1

3384381c2c603b8145e47c9c1178fffa18d1f123
SHA256

7df9461a6e0cc0bfaa99662e0daa3516ae3ceea1d2e869b8706d6dd61d4d5f7f
SHA512

4b46865f39ae8837aeaedfdf4f2c3ffa026e3f79ebdede55d9e6fe8cc953bef7888957cc723536d93f589166b513db036419b6fc4622f369fa145b519e2420a5
SSDEEP

6144:IZvXhcHqGZSVTQABH+DvjB2cLLTOiGysJd:I9xcV4EAczjBKil8

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1252 set thread context of 1412	1252	TEMP~1.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1412	TEMP~1.exe
1412	TEMP~1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1252	TEMP~1.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1412	1252	TEMP~1.exe	28
PID 1252 wrote to memory of 1412	1252	TEMP~1.exe	28
PID 1252 wrote to memory of 1412	1252	TEMP~1.exe	28
PID 1252 wrote to memory of 1412	1252	TEMP~1.exe	28
PID 1252 wrote to memory of 1412	1252	TEMP~1.exe	28
PID 1252 wrote to memory of 1412	1252	TEMP~1.exe	28
PID 1252 wrote to memory of 1412	1252	TEMP~1.exe	28
PID 1412 wrote to memory of 1272	1412	TEMP~1.exe	21
PID 1412 wrote to memory of 1272	1412	TEMP~1.exe	21
PID 1412 wrote to memory of 1272	1412	TEMP~1.exe	21
PID 1412 wrote to memory of 1272	1412	TEMP~1.exe	21

memory/1252-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1252-55-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1252-62-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1272-65-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1412-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1412-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1412-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1412-63-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1412-68-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download