eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d

Analysis

max time kernel
146s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2023, 08:57

Target

eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe
Size

775KB
MD5

68c43b3ca349cc9a76a0a0d52be2e53f
SHA1

1dd8bb9ce6d321302cb5a5f5d83ddf9fba4a7edd
SHA256

eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d
SHA512

7c774ee666d1e478874f391dc7f43f15e7c0727b656266911b004a9bcd3e682f1896d0dec2c1ca2d7cb8c791a0b692a9cf0ad512b30c266d8cff90f69ed902a6
SSDEEP

12288:r5vJRBusyg5voG1vdKx5yb1+MCyoKhnl1fRIRDmTD4BUrLUJevU:FFuMusC0eFcnlxRIlmnwevU

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 3608	2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe	96

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe
2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe
3608	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe
3608	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2444	2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe	95
PID 2212 wrote to memory of 2444	2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe	95
PID 2212 wrote to memory of 2444	2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe	95
PID 2212 wrote to memory of 3608	2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe	96
PID 2212 wrote to memory of 3608	2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe	96
PID 2212 wrote to memory of 3608	2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe	96
PID 2212 wrote to memory of 3608	2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe	96
PID 2212 wrote to memory of 3608	2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe	96
PID 2212 wrote to memory of 3608	2212	eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe	96

C:\Users\Admin\AppData\Local\Temp\eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe
"C:\Users\Admin\AppData\Local\Temp\eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe
  "C:\Users\Admin\AppData\Local\Temp\eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe"
  2⤵
  PID:2444
- C:\Users\Admin\AppData\Local\Temp\eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe
  "C:\Users\Admin\AppData\Local\Temp\eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3608

memory/2212-139-0x0000000004E90000-0x0000000004E9A000-memory.dmp

Filesize
40KB

Download
memory/2212-134-0x00000000003D0000-0x0000000000498000-memory.dmp

Filesize
800KB

Download
memory/2212-135-0x0000000005510000-0x0000000005AB4000-memory.dmp

Filesize
5.6MB

Download
memory/2212-136-0x0000000004EA0000-0x0000000004F32000-memory.dmp

Filesize
584KB

Download
memory/2212-137-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/2212-138-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/2212-133-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/2212-140-0x0000000005140000-0x00000000051DC000-memory.dmp

Filesize
624KB

Download
memory/2212-141-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/2212-144-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/3608-142-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3608-145-0x0000000001450000-0x000000000179A000-memory.dmp

Filesize
3.3MB

Download
memory/3608-146-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download