357f5843804874c6728b48ac3c2ce1fd4323a3bfa46c7acbf02eb2b9c2b5795d

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/01/2023, 19:27

Target

52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe
Size

834KB
MD5

ba09f284f6f8acb6400d6d8ccddd0993
SHA1

154fb9974cb4ca8afd2360ca2bf676993f43f2db
SHA256

52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6
SHA512

98bc6aae1b65997c5884f79114baa96f32c1a8e018403038cb3a2f1785d99b8feb892eaf41a1624968dbe63842ae0d98bd66e80de0d3aa17f9dcea01efe224e5
SSDEEP

24576:2qO1lo4HqTEa+XMiZG7BAZJXKrAT35YnW/nuBvOfkMFEGmFz:H0cTEfpi+zXK8T35YiuBvOvhm

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 1348	1636	52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1348	1636	52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe	27
PID 1636 wrote to memory of 1348	1636	52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe	27
PID 1636 wrote to memory of 1348	1636	52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe	27
PID 1636 wrote to memory of 1348	1636	52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe	27
PID 1636 wrote to memory of 1348	1636	52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe	27
PID 1636 wrote to memory of 1348	1636	52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe	27
PID 1636 wrote to memory of 1348	1636	52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe	27
PID 1636 wrote to memory of 1348	1636	52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe	27
PID 1636 wrote to memory of 1348	1636	52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe	27

C:\Users\Admin\AppData\Local\Temp\52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe
"C:\Users\Admin\AppData\Local\Temp\52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe
  C:\Users\Admin\AppData\Local\Temp\52d37ef5f414ea192c1512f8740e0bb53e2d85ca04f133468a5267b491cb2ce6.exe
  2⤵
  PID:1348

memory/1636-54-0x00000000000F0000-0x00000000001C6000-memory.dmp

Filesize
856KB

Download
memory/1636-55-0x0000000004550000-0x0000000004650000-memory.dmp

Filesize
1024KB

Download