a3225cdecee4f51aef9815859cdbaa70d5ce3b5e97d52518a5e0c5e2ac5deb12

Analysis

max time kernel
77s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2023, 05:55

Target
02cb6a9878f4c01dd654c87361dc83d7.exe
Size 681KB
Sample230418-gmfq6abe9s
SHA256 a3225cdecee4f51aef9815859cdbaa70d5ce3b5e97d52518a5e0c5e2ac5deb12
MD5 02cb6a9878f4c01dd654c87361dc83d7
SHA1 0bde6676cc36d9db691b90fe93fa13316aec71d5
SHA512 70e4fade2c4ad40e9a2faa43578f0cb5873c620a2f5380fca7548945ee11c53e69f8ee41c603124538f8f13971852c97561694280dfad5eafe3e792d364f2c73
SSDEEP 12288:DuUZHOYnQ6r2930JOisRkpfZhw0eJQTqUrgUvdzyW7gBkDlOKpRD066hJ:1kYJ29gOq7XTQUVzyWikhpGB
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4380 set thread context of 1636	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	94

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	02cb6a9878f4c01dd654c87361dc83d7.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 4628	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	91
PID 4380 wrote to memory of 4628	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	91
PID 4380 wrote to memory of 4628	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	91
PID 4380 wrote to memory of 2968	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	92
PID 4380 wrote to memory of 2968	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	92
PID 4380 wrote to memory of 2968	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	92
PID 4380 wrote to memory of 3152	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	93
PID 4380 wrote to memory of 3152	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	93
PID 4380 wrote to memory of 3152	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	93
PID 4380 wrote to memory of 1636	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	94
PID 4380 wrote to memory of 1636	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	94
PID 4380 wrote to memory of 1636	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	94
PID 4380 wrote to memory of 1636	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	94
PID 4380 wrote to memory of 1636	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	94
PID 4380 wrote to memory of 1636	4380	02cb6a9878f4c01dd654c87361dc83d7.exe	94

C:\Users\Admin\AppData\Local\Temp\02cb6a9878f4c01dd654c87361dc83d7.exe
"C:\Users\Admin\AppData\Local\Temp\02cb6a9878f4c01dd654c87361dc83d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\02cb6a9878f4c01dd654c87361dc83d7.exe
  "C:\Users\Admin\AppData\Local\Temp\02cb6a9878f4c01dd654c87361dc83d7.exe"
  2⤵
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\02cb6a9878f4c01dd654c87361dc83d7.exe
  "C:\Users\Admin\AppData\Local\Temp\02cb6a9878f4c01dd654c87361dc83d7.exe"
  2⤵
  PID:2968
- C:\Users\Admin\AppData\Local\Temp\02cb6a9878f4c01dd654c87361dc83d7.exe
  "C:\Users\Admin\AppData\Local\Temp\02cb6a9878f4c01dd654c87361dc83d7.exe"
  2⤵
  PID:3152
- C:\Users\Admin\AppData\Local\Temp\02cb6a9878f4c01dd654c87361dc83d7.exe
  "C:\Users\Admin\AppData\Local\Temp\02cb6a9878f4c01dd654c87361dc83d7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636

memory/1636-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1636-142-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1636-143-0x00000000010C0000-0x000000000140A000-memory.dmp

Download

memory/4380-133-0x0000000000DD0000-0x0000000000E80000-memory.dmp

Download

memory/4380-134-0x0000000005CC0000-0x0000000006264000-memory.dmp

Download

memory/4380-135-0x0000000005810000-0x00000000058A2000-memory.dmp

Download

memory/4380-136-0x00000000058C0000-0x00000000058CA000-memory.dmp

Download

memory/4380-137-0x0000000005990000-0x00000000059A0000-memory.dmp

Download

memory/4380-138-0x0000000005990000-0x00000000059A0000-memory.dmp

Download

memory/4380-139-0x00000000072E0000-0x000000000737C000-memory.dmp

Download