b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9

Analysis

max time kernel
38s
max time network
49s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 07:11

Target

b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe
Size

128KB
MD5

b59b9779e34b6ab7c3b92e3666823a2b
SHA1

75e7452339458562f01d7290c2af2ee32de9cb2b
SHA256

b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9
SHA512

a2cb5103b403c8071f9ece3c20a891022a47aa9b0f178c87f3a5d37b7fb475d03f6a6189f366b91c0fa0f9d7410a741e6c68eacd1a586fd17ba3d2d9eff35fb3
SSDEEP

3072:fewvFTjuyu6dj2J67lgOSz+9xNYuQbB/F0zW7qnYEwg91l80L80FY3FguRXl:Lvxa8dS6eOSz+HNYX90zWcH91jLKFguf

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1624	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 1624	2032	b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2032	b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe
2032	b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1624	2032	b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe	28
PID 2032 wrote to memory of 1624	2032	b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe	28
PID 2032 wrote to memory of 1624	2032	b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe	28
PID 2032 wrote to memory of 1624	2032	b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe	28
PID 2032 wrote to memory of 1624	2032	b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe	28

C:\Users\Admin\AppData\Local\Temp\b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe
"C:\Users\Admin\AppData\Local\Temp\b336524fdcd352829949e29a8ba4149ba7ed32dcd967fde039f0704fdb1722c9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:1624

memory/2032-54-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/2032-55-0x00000000002F0000-0x000000000030F000-memory.dmp

Filesize
124KB

Download
memory/2032-59-0x00000000002F0000-0x000000000030F000-memory.dmp

Filesize
124KB

Download
memory/2032-63-0x00000000002F0000-0x000000000030F000-memory.dmp

Filesize
124KB

Download
memory/2032-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2032-65-0x0000000000230000-0x0000000000237000-memory.dmp

Filesize
28KB

Download
memory/2032-67-0x00000000003C0000-0x00000000003DD000-memory.dmp

Filesize
116KB

Download