76cded40cd51eeb98f734dafed6ac0b0562d847a48b5d42a9b55d11dd73f1d21

Analysis

max time kernel
90s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2023, 15:53

Target
58011275adaa797e50a82420cf61247a.exe
Size 816KB
Sample230201-tbl51scd5x
SHA256 76cded40cd51eeb98f734dafed6ac0b0562d847a48b5d42a9b55d11dd73f1d21
MD5 58011275adaa797e50a82420cf61247a
SHA1 8596de7f01f1c10753e2c167c0a2d4f923cbf165
SHA512 f18dd5c6c2592d403ed6efa47f82064adf11f957184507dd15ab3454d7772267bc322d7b1788eb7c4d0fec98853f3ae8aa58e4daa35d0eb5c720a71982e99e77
SSDEEP 24576:BeCalr8/BJzDMPUIiiN92Ndew6Rhc4N34:Bolr8/PXGviiQA
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4944 set thread context of 724	4944	58011275adaa797e50a82420cf61247a.exe	89

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	58011275adaa797e50a82420cf61247a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 440	4944	58011275adaa797e50a82420cf61247a.exe	88
PID 4944 wrote to memory of 440	4944	58011275adaa797e50a82420cf61247a.exe	88
PID 4944 wrote to memory of 440	4944	58011275adaa797e50a82420cf61247a.exe	88
PID 4944 wrote to memory of 724	4944	58011275adaa797e50a82420cf61247a.exe	89
PID 4944 wrote to memory of 724	4944	58011275adaa797e50a82420cf61247a.exe	89
PID 4944 wrote to memory of 724	4944	58011275adaa797e50a82420cf61247a.exe	89
PID 4944 wrote to memory of 724	4944	58011275adaa797e50a82420cf61247a.exe	89
PID 4944 wrote to memory of 724	4944	58011275adaa797e50a82420cf61247a.exe	89
PID 4944 wrote to memory of 724	4944	58011275adaa797e50a82420cf61247a.exe	89

C:\Users\Admin\AppData\Local\Temp\58011275adaa797e50a82420cf61247a.exe
"C:\Users\Admin\AppData\Local\Temp\58011275adaa797e50a82420cf61247a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\58011275adaa797e50a82420cf61247a.exe
  "C:\Users\Admin\AppData\Local\Temp\58011275adaa797e50a82420cf61247a.exe"
  2⤵
  PID:440
- C:\Users\Admin\AppData\Local\Temp\58011275adaa797e50a82420cf61247a.exe
  "C:\Users\Admin\AppData\Local\Temp\58011275adaa797e50a82420cf61247a.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:724

memory/724-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/724-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/724-141-0x0000000001710000-0x0000000001A5A000-memory.dmp

Download

memory/4944-132-0x00000000001E0000-0x00000000002B0000-memory.dmp

Download

memory/4944-133-0x00000000051F0000-0x0000000005794000-memory.dmp

Download

memory/4944-134-0x0000000004CE0000-0x0000000004D72000-memory.dmp

Download

memory/4944-135-0x0000000004C60000-0x0000000004C6A000-memory.dmp

Download

memory/4944-136-0x0000000008690000-0x000000000872C000-memory.dmp

Download