9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 03:46

Target

9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe
Size

205KB
MD5

9ae84c18aa3f350abe35df0df689f90f
SHA1

bd4030a998756c67c30443352c12d447a08f8c28
SHA256

9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae
SHA512

3909492b061ebaf7837db8a90b0a45ada8b77c94cebda02863a6deb491447145cbb5a1433d5ae8e25896816eff8640a2440ba341c2177ffc93f3c172f730f98c
SSDEEP

6144:LituWxVQlS8ad21jHsDtasJW1aG43SO62dSG:LiouelS8ad21jm443tuG

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1588	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4640 set thread context of 1588	4640	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4640	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe
4640	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe
Token: SeDebugPrivilege	4640	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1588	4640	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	81
PID 4640 wrote to memory of 1588	4640	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	81
PID 4640 wrote to memory of 1588	4640	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	81
PID 4640 wrote to memory of 1588	4640	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	81

C:\Users\Admin\AppData\Local\Temp\9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe
"C:\Users\Admin\AppData\Local\Temp\9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:1588

memory/4640-132-0x0000000030670000-0x00000000306C2000-memory.dmp

Filesize
328KB

Download
memory/4640-133-0x0000000002480000-0x00000000024D2000-memory.dmp

Filesize
328KB

Download
memory/4640-134-0x0000000030670000-0x00000000306C2000-memory.dmp

Filesize
328KB

Download
memory/4640-136-0x0000000002480000-0x00000000024D2000-memory.dmp

Filesize
328KB

Download