d8ca7bcd60d1a2f76f18a52205f16b6024ffdf16b9dcd4d01e263b5a339f3b1e

Analysis

max time kernel
109s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 18:00

Target

d8ca7bcd60d1a2f76f18a52205f16b6024ffdf16b9dcd4d01e263b5a339f3b1e.exe
Size

221KB
MD5

41240699349b0f488828a6dc065e64d8
SHA1

901d88e266aededbb807753739b0f2b6d1679b6e
SHA256

d8ca7bcd60d1a2f76f18a52205f16b6024ffdf16b9dcd4d01e263b5a339f3b1e
SHA512

7f971d3a31cf51eb80f2c521c7dd2810c790f5094bb47fc4442313fc52a849f55679a423d00a580129da37eff24516583687e8d96392c23e6aa199e7a7a9103d
SSDEEP

6144:Z6sRj70QVZRhAeUKjxjgFNYjLMJrsSicWHZuZ:Z6siEGeUeDbNZu

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1412	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 516 set thread context of 1412	516	d8ca7bcd60d1a2f76f18a52205f16b6024ffdf16b9dcd4d01e263b5a339f3b1e.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	516	d8ca7bcd60d1a2f76f18a52205f16b6024ffdf16b9dcd4d01e263b5a339f3b1e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 1412	516	d8ca7bcd60d1a2f76f18a52205f16b6024ffdf16b9dcd4d01e263b5a339f3b1e.exe	82
PID 516 wrote to memory of 1412	516	d8ca7bcd60d1a2f76f18a52205f16b6024ffdf16b9dcd4d01e263b5a339f3b1e.exe	82
PID 516 wrote to memory of 1412	516	d8ca7bcd60d1a2f76f18a52205f16b6024ffdf16b9dcd4d01e263b5a339f3b1e.exe	82
PID 516 wrote to memory of 1412	516	d8ca7bcd60d1a2f76f18a52205f16b6024ffdf16b9dcd4d01e263b5a339f3b1e.exe	82

C:\Users\Admin\AppData\Local\Temp\d8ca7bcd60d1a2f76f18a52205f16b6024ffdf16b9dcd4d01e263b5a339f3b1e.exe
"C:\Users\Admin\AppData\Local\Temp\d8ca7bcd60d1a2f76f18a52205f16b6024ffdf16b9dcd4d01e263b5a339f3b1e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:1412

memory/516-132-0x0000000002090000-0x00000000020E7000-memory.dmp

Filesize
348KB

Download
memory/516-133-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/516-134-0x0000000002090000-0x00000000020E7000-memory.dmp

Filesize
348KB

Download
memory/516-135-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/516-137-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download