a97aa6604d2ad5146a8ef252e571d4b0c1e2ee8566964be8086532ef049b10d4

Analysis

max time kernel
41s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/02/2023, 15:52

Target
cbd51ff5d3feb548256a96e491d22100.exe
Size 798KB
Sample230201-ta25vaae26
SHA256 a97aa6604d2ad5146a8ef252e571d4b0c1e2ee8566964be8086532ef049b10d4
MD5 cbd51ff5d3feb548256a96e491d22100
SHA1 af39615fbe91de2772dcd92ecec6cacfdf9c254e
SHA512 09b03af2a7414b9a73721e39381461811b61cca03eacdb97b8b5bf7e1da54e3adf4fa0dce578a4ed96dac977e03587901bbcd80cc171d96d87b4ff9a3930b7c5
SSDEEP 24576:sXHig3UEtclUxmYUanPaCtr8zw6R5c4N34:sXHfEkFVRPaer8z
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1292 set thread context of 676	1292	cbd51ff5d3feb548256a96e491d22100.exe	31

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	cbd51ff5d3feb548256a96e491d22100.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 268	1292	cbd51ff5d3feb548256a96e491d22100.exe	28
PID 1292 wrote to memory of 268	1292	cbd51ff5d3feb548256a96e491d22100.exe	28
PID 1292 wrote to memory of 268	1292	cbd51ff5d3feb548256a96e491d22100.exe	28
PID 1292 wrote to memory of 268	1292	cbd51ff5d3feb548256a96e491d22100.exe	28
PID 1292 wrote to memory of 480	1292	cbd51ff5d3feb548256a96e491d22100.exe	29
PID 1292 wrote to memory of 480	1292	cbd51ff5d3feb548256a96e491d22100.exe	29
PID 1292 wrote to memory of 480	1292	cbd51ff5d3feb548256a96e491d22100.exe	29
PID 1292 wrote to memory of 480	1292	cbd51ff5d3feb548256a96e491d22100.exe	29
PID 1292 wrote to memory of 1528	1292	cbd51ff5d3feb548256a96e491d22100.exe	30
PID 1292 wrote to memory of 1528	1292	cbd51ff5d3feb548256a96e491d22100.exe	30
PID 1292 wrote to memory of 1528	1292	cbd51ff5d3feb548256a96e491d22100.exe	30
PID 1292 wrote to memory of 1528	1292	cbd51ff5d3feb548256a96e491d22100.exe	30
PID 1292 wrote to memory of 676	1292	cbd51ff5d3feb548256a96e491d22100.exe	31
PID 1292 wrote to memory of 676	1292	cbd51ff5d3feb548256a96e491d22100.exe	31
PID 1292 wrote to memory of 676	1292	cbd51ff5d3feb548256a96e491d22100.exe	31
PID 1292 wrote to memory of 676	1292	cbd51ff5d3feb548256a96e491d22100.exe	31
PID 1292 wrote to memory of 676	1292	cbd51ff5d3feb548256a96e491d22100.exe	31
PID 1292 wrote to memory of 676	1292	cbd51ff5d3feb548256a96e491d22100.exe	31
PID 1292 wrote to memory of 676	1292	cbd51ff5d3feb548256a96e491d22100.exe	31

C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe
"C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe
  "C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe"
  2⤵
  PID:268
- C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe
  "C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe"
  2⤵
  PID:480
- C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe
  "C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe"
  2⤵
  PID:1528
- C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe
  "C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676

memory/676-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/676-61-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/676-63-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/676-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/676-66-0x0000000000830000-0x0000000000B33000-memory.dmp

Download

memory/1292-54-0x0000000001090000-0x000000000115E000-memory.dmp

Download

memory/1292-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Download

memory/1292-56-0x0000000000500000-0x0000000000514000-memory.dmp

Download

memory/1292-57-0x0000000000650000-0x000000000065A000-memory.dmp

Download

memory/1292-58-0x0000000007D40000-0x0000000007DB0000-memory.dmp

Download

memory/1292-59-0x0000000000C30000-0x0000000000C66000-memory.dmp

Download