1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b

Analysis

max time kernel
60s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2023, 13:25

Target
1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe
Size 750KB
Sample230403-qnysssfa59
SHA256 1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b
MD5 f463680f1ca137f422fba9a817f8365e
SHA1 a7546db350deabb78a34c1c5ad9407080d5ff0d2
SHA512 30c861464b6cba43ffbd6bb9d8f80fd2e8ae7a03dce53213bbe953d093c2639e06504859922c4427c0a2ec99f7d387197d1b8be9b7d4708b5440cd98fe9942b0
SSDEEP 12288:6XXmYMUnFW/Nfb1zBZ/0w93Vw5PFQnH8A6+gH6vjbP7Gob7X2S9NkDWihtf:6XXUhdBZ/0glXM6PP7G+YDR
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 2244	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	92

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 4124	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	90
PID 1464 wrote to memory of 4124	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	90
PID 1464 wrote to memory of 4124	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	90
PID 1464 wrote to memory of 4812	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	91
PID 1464 wrote to memory of 4812	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	91
PID 1464 wrote to memory of 4812	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	91
PID 1464 wrote to memory of 2244	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	92
PID 1464 wrote to memory of 2244	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	92
PID 1464 wrote to memory of 2244	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	92
PID 1464 wrote to memory of 2244	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	92
PID 1464 wrote to memory of 2244	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	92
PID 1464 wrote to memory of 2244	1464	1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe	92

C:\Users\Admin\AppData\Local\Temp\1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe
"C:\Users\Admin\AppData\Local\Temp\1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe
  "C:\Users\Admin\AppData\Local\Temp\1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe"
  2⤵
  PID:4124
- C:\Users\Admin\AppData\Local\Temp\1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe
  "C:\Users\Admin\AppData\Local\Temp\1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe"
  2⤵
  PID:4812
- C:\Users\Admin\AppData\Local\Temp\1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe
  "C:\Users\Admin\AppData\Local\Temp\1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244

memory/1464-133-0x0000000000EE0000-0x0000000000FA2000-memory.dmp

Download

memory/1464-134-0x0000000005ED0000-0x0000000006474000-memory.dmp

Download

memory/1464-135-0x00000000059C0000-0x0000000005A52000-memory.dmp

Download

memory/1464-136-0x0000000005970000-0x000000000597A000-memory.dmp

Download

memory/1464-137-0x0000000005B10000-0x0000000005B20000-memory.dmp

Download

memory/1464-138-0x0000000005B10000-0x0000000005B20000-memory.dmp

Download

memory/1464-139-0x00000000075C0000-0x000000000765C000-memory.dmp

Download

memory/2244-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2244-142-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2244-143-0x00000000019E0000-0x0000000001D2A000-memory.dmp

Download