ec39fbbd1e1e1d31c99297d019c3baba5e12fbc395507a6345069f653b38f1f0

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2023 10:35

Target

1_video_mp4_misshas_colloborations_promoutions_1280_720_niv.mp4.scr.exe
Size

778KB
MD5

d92c29e168813fadff8e6c63af7d1c15
SHA1

b5bcc9435d385d142d00e010c77d9b0901b1f866
SHA256

ec39fbbd1e1e1d31c99297d019c3baba5e12fbc395507a6345069f653b38f1f0
SHA512

6a64d1be16f1911bbd26c9eb332385f0592f26e8d603fe63b6aacfdcf3b08ad0b289f8567e6702f81948f58712a344a6c562e4284254252e7e35683c1b62d7f4
SSDEEP

24576:NnUverXwQUCHazvUGKVmklx9m+ZtUqUOCUbUUZUeUwUNUqUGUpUVUFUYU5UYU/Ux:NUverXhp

Score

7^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4152 set thread context of 4392	4152	1_video_mp4_misshas_colloborations_promoutions_1280_720_niv.mp4.scr.exe	80

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4392	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	vbc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 4392	4152	1_video_mp4_misshas_colloborations_promoutions_1280_720_niv.mp4.scr.exe	80
PID 4152 wrote to memory of 4392	4152	1_video_mp4_misshas_colloborations_promoutions_1280_720_niv.mp4.scr.exe	80
PID 4152 wrote to memory of 4392	4152	1_video_mp4_misshas_colloborations_promoutions_1280_720_niv.mp4.scr.exe	80
PID 4152 wrote to memory of 4392	4152	1_video_mp4_misshas_colloborations_promoutions_1280_720_niv.mp4.scr.exe	80
PID 4152 wrote to memory of 4392	4152	1_video_mp4_misshas_colloborations_promoutions_1280_720_niv.mp4.scr.exe	80
PID 4152 wrote to memory of 4392	4152	1_video_mp4_misshas_colloborations_promoutions_1280_720_niv.mp4.scr.exe	80
PID 4152 wrote to memory of 4392	4152	1_video_mp4_misshas_colloborations_promoutions_1280_720_niv.mp4.scr.exe	80
PID 4152 wrote to memory of 4392	4152	1_video_mp4_misshas_colloborations_promoutions_1280_720_niv.mp4.scr.exe	80

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4152-132-0x0000000000C10000-0x0000000000C98000-memory.dmp

Filesize
544KB

Download
memory/4152-133-0x0000000005BB0000-0x0000000006154000-memory.dmp

Filesize
5.6MB

Download
memory/4152-134-0x00000000056A0000-0x0000000005732000-memory.dmp

Filesize
584KB

Download
memory/4152-135-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download
memory/4392-136-0x0000000000000000-mapping.dmp

Download
memory/4392-137-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4392-138-0x0000000005C20000-0x0000000006238000-memory.dmp

Filesize
6.1MB

Download
memory/4392-139-0x0000000005620000-0x0000000005632000-memory.dmp

Filesize
72KB

Download
memory/4392-140-0x0000000005750000-0x000000000585A000-memory.dmp

Filesize
1.0MB

Download
memory/4392-141-0x0000000005680000-0x00000000056BC000-memory.dmp

Filesize
240KB

Download
memory/4392-142-0x0000000006A20000-0x0000000006A96000-memory.dmp

Filesize
472KB

Download
memory/4392-143-0x0000000007DC0000-0x0000000007F82000-memory.dmp

Filesize
1.8MB

Download
memory/4392-144-0x00000000084C0000-0x00000000089EC000-memory.dmp

Filesize
5.2MB

Download
memory/4392-145-0x0000000007BF0000-0x0000000007C0E000-memory.dmp

Filesize
120KB

Download