9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724

Analysis

max time kernel
147s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 00:23

Target

9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe
Size

37KB
MD5

00dbc0280f5972d2e2062e88e9d13c8b
SHA1

1e05f8c8ae6e7a53ad30183ea99898bd02938ee5
SHA256

9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724
SHA512

1a27624a037ed8059d973aad8d25866571de0b13faffd79461143d70a5b9a6d80544aa0e485cb91cc272d3e6f9aa662f9b53521ff39b17912b5391f540e0909d
SSDEEP

768:+wfNZWNafCf0d94cf9L4B7o3f/asZNredDYZwphLKlLfdIc:+w1ZSakG9hz3fCsSYaphLILr

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 4964	4460	9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4964	4460	9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe	81
PID 4460 wrote to memory of 4964	4460	9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe	81
PID 4460 wrote to memory of 4964	4460	9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe	81
PID 4460 wrote to memory of 4964	4460	9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe	81
PID 4460 wrote to memory of 4964	4460	9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe	81
PID 4460 wrote to memory of 4964	4460	9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe	81
PID 4460 wrote to memory of 4964	4460	9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe	81
PID 4460 wrote to memory of 4964	4460	9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe	81
PID 4460 wrote to memory of 4964	4460	9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe	81

C:\Users\Admin\AppData\Local\Temp\9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe
"C:\Users\Admin\AppData\Local\Temp\9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe
  "C:\Users\Admin\AppData\Local\Temp\9e18fd0da926b2a25d762d46cd4c4e9526eae5dcaaddd98f6dbc21615b527724.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4964

memory/4964-132-0x0000000000000000-mapping.dmp

Download
memory/4964-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4964-134-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4964-135-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download