0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c

Resubmissions

12/01/2023, 13:32

12/01/2023, 12:40

05/01/2023, 13:57

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/01/2023, 12:40

Target

0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe
Size

504KB
MD5

b7b0901eee1bbd42d38830e62082bfdb
SHA1

ac4d1845aacabdbf872cc6344eb39c604b3b010c
SHA256

0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c
SHA512

d091d0787a5060f150dd59e70adb768b3def49bbfe80afcf8c1d505a5ae8fda514aca2eb8d02e7ef7537a0366df1e1b1d1a83fbd8e6c8d952e72eeb7655fb6a9
SSDEEP

12288:e8DSlNIUUpg9hYONfR7XP+UKKM6mz7Rawpg833DX:bwOUUmhvN5TP+Cchg83T

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 872 set thread context of 1724	872	0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1724	gpscript.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	gpscript.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1724	872	0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe	27
PID 872 wrote to memory of 1724	872	0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe	27
PID 872 wrote to memory of 1724	872	0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe	27
PID 872 wrote to memory of 1724	872	0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe	27
PID 872 wrote to memory of 1724	872	0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe	27
PID 872 wrote to memory of 1724	872	0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe	27
PID 872 wrote to memory of 1724	872	0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe	27
PID 872 wrote to memory of 1724	872	0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe	27
PID 872 wrote to memory of 1724	872	0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe	27
PID 872 wrote to memory of 1724	872	0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe	27
PID 872 wrote to memory of 1724	872	0820f236393d65a390ae4ae38e297847d3e2b5a1529b8977aadd875dbe0eac2c.exe	27

memory/1724-54-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1724-56-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1724-59-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1724-62-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1724-65-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1724-67-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1724-70-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1724-72-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/1724-73-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download