a97aa6604d2ad5146a8ef252e571d4b0c1e2ee8566964be8086532ef049b10d4

Analysis

max time kernel
112s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2023, 15:52

Target
cbd51ff5d3feb548256a96e491d22100.exe
Size 798KB
Sample230201-ta25vaae26
SHA256 a97aa6604d2ad5146a8ef252e571d4b0c1e2ee8566964be8086532ef049b10d4
MD5 cbd51ff5d3feb548256a96e491d22100
SHA1 af39615fbe91de2772dcd92ecec6cacfdf9c254e
SHA512 09b03af2a7414b9a73721e39381461811b61cca03eacdb97b8b5bf7e1da54e3adf4fa0dce578a4ed96dac977e03587901bbcd80cc171d96d87b4ff9a3930b7c5
SSDEEP 24576:sXHig3UEtclUxmYUanPaCtr8zw6R5c4N34:sXHfEkFVRPaer8z
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4664 set thread context of 4204	4664	cbd51ff5d3feb548256a96e491d22100.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	cbd51ff5d3feb548256a96e491d22100.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3740	4664	cbd51ff5d3feb548256a96e491d22100.exe	83
PID 4664 wrote to memory of 3740	4664	cbd51ff5d3feb548256a96e491d22100.exe	83
PID 4664 wrote to memory of 3740	4664	cbd51ff5d3feb548256a96e491d22100.exe	83
PID 4664 wrote to memory of 4204	4664	cbd51ff5d3feb548256a96e491d22100.exe	84
PID 4664 wrote to memory of 4204	4664	cbd51ff5d3feb548256a96e491d22100.exe	84
PID 4664 wrote to memory of 4204	4664	cbd51ff5d3feb548256a96e491d22100.exe	84
PID 4664 wrote to memory of 4204	4664	cbd51ff5d3feb548256a96e491d22100.exe	84
PID 4664 wrote to memory of 4204	4664	cbd51ff5d3feb548256a96e491d22100.exe	84
PID 4664 wrote to memory of 4204	4664	cbd51ff5d3feb548256a96e491d22100.exe	84

C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe
"C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe
  "C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe"
  2⤵
  PID:3740
- C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe
  "C:\Users\Admin\AppData\Local\Temp\cbd51ff5d3feb548256a96e491d22100.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204

memory/4204-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4204-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4204-141-0x00000000018C0000-0x0000000001C0A000-memory.dmp

Download

memory/4664-132-0x0000000000960000-0x0000000000A2E000-memory.dmp

Download

memory/4664-133-0x00000000059E0000-0x0000000005F84000-memory.dmp

Download

memory/4664-134-0x0000000005430000-0x00000000054C2000-memory.dmp

Download

memory/4664-135-0x00000000053C0000-0x00000000053CA000-memory.dmp

Download

memory/4664-136-0x0000000008DF0000-0x0000000008E8C000-memory.dmp

Download