4e76c680beb65149bcd635087a716ec03bbeed03d722482a959a3ddaa8671fc4

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2023, 18:42

Target
a2fc650660b1067964c712db898be0cb.exe
Size 575KB
Sample230214-xcbx8aeg7v
SHA256 4e76c680beb65149bcd635087a716ec03bbeed03d722482a959a3ddaa8671fc4
MD5 a2fc650660b1067964c712db898be0cb
SHA1 a71d989effca3b54ebbc6599fc2a81ed839179d1
SHA512 59da567d386e85152b10711c36508af07c1afe95fe12fb420904b900af50bd3b2e6eb681cc6654611583f53b732a73611c568e4c3f10bc63cc97c2d604484f3b
SSDEEP 12288:DlFFZ6S9fQdkTO7fYbimytvYJPQD4J11wuhCNdcEtvJ+Kzk/5Hm8Z5YiW:D6S9fQdkakUYZKsL4v1zk/o8Zy
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4528 set thread context of 3276	4528	a2fc650660b1067964c712db898be0cb.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	a2fc650660b1067964c712db898be0cb.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3176	4528	a2fc650660b1067964c712db898be0cb.exe	84
PID 4528 wrote to memory of 3176	4528	a2fc650660b1067964c712db898be0cb.exe	84
PID 4528 wrote to memory of 3176	4528	a2fc650660b1067964c712db898be0cb.exe	84
PID 4528 wrote to memory of 3276	4528	a2fc650660b1067964c712db898be0cb.exe	85
PID 4528 wrote to memory of 3276	4528	a2fc650660b1067964c712db898be0cb.exe	85
PID 4528 wrote to memory of 3276	4528	a2fc650660b1067964c712db898be0cb.exe	85
PID 4528 wrote to memory of 3276	4528	a2fc650660b1067964c712db898be0cb.exe	85
PID 4528 wrote to memory of 3276	4528	a2fc650660b1067964c712db898be0cb.exe	85
PID 4528 wrote to memory of 3276	4528	a2fc650660b1067964c712db898be0cb.exe	85

C:\Users\Admin\AppData\Local\Temp\a2fc650660b1067964c712db898be0cb.exe
"C:\Users\Admin\AppData\Local\Temp\a2fc650660b1067964c712db898be0cb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Local\Temp\a2fc650660b1067964c712db898be0cb.exe
  "C:\Users\Admin\AppData\Local\Temp\a2fc650660b1067964c712db898be0cb.exe"
  2⤵
  PID:3176
- C:\Users\Admin\AppData\Local\Temp\a2fc650660b1067964c712db898be0cb.exe
  "C:\Users\Admin\AppData\Local\Temp\a2fc650660b1067964c712db898be0cb.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276

memory/3276-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3276-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3276-141-0x0000000001290000-0x00000000015DA000-memory.dmp

Download

memory/4528-132-0x0000000000820000-0x00000000008B6000-memory.dmp

Download

memory/4528-133-0x0000000005900000-0x0000000005EA4000-memory.dmp

Download

memory/4528-134-0x0000000005350000-0x00000000053E2000-memory.dmp

Download

memory/4528-135-0x0000000005270000-0x000000000527A000-memory.dmp

Download

memory/4528-136-0x00000000090B0000-0x000000000914C000-memory.dmp

Download