f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab

Analysis

max time kernel
193s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 07:37

Target

f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe
Size

221KB
MD5

e15d8700a8d09296ec064d28d8c6876e
SHA1

679b51d60e6993c269ee04d1c3419be1904740c7
SHA256

f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab
SHA512

c25ee74ec87cd239c9e081a076baca98d8417ff09520ebf57b11d47c91771e2eef6d8f4baf9ddd77c6cf7f5d537437e49e533f7992f666e9906afa42574741d7
SSDEEP

6144:ZAJ9Xg6FQtBClSnDpZM3jItzSiSVo0E9:ZAJJLQtvnVa3ag+

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3940	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 756 set thread context of 3940	756	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
756	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe
756	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe
Token: SeDebugPrivilege	756	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 3940	756	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	79
PID 756 wrote to memory of 3940	756	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	79
PID 756 wrote to memory of 3940	756	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	79
PID 756 wrote to memory of 3940	756	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	79

C:\Users\Admin\AppData\Local\Temp\f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe
"C:\Users\Admin\AppData\Local\Temp\f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:3940

memory/756-133-0x0000000000560000-0x00000000005ED000-memory.dmp

Filesize
564KB

Download
memory/756-132-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/756-134-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/756-135-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/756-136-0x0000000000560000-0x00000000005ED000-memory.dmp

Filesize
564KB

Download