eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2023 09:41

Target

68c43b3ca349cc9a76a0a0d52be2e53f.exe
Size

775KB
MD5

68c43b3ca349cc9a76a0a0d52be2e53f
SHA1

1dd8bb9ce6d321302cb5a5f5d83ddf9fba4a7edd
SHA256

eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d
SHA512

7c774ee666d1e478874f391dc7f43f15e7c0727b656266911b004a9bcd3e682f1896d0dec2c1ca2d7cb8c791a0b692a9cf0ad512b30c266d8cff90f69ed902a6
SSDEEP

12288:r5vJRBusyg5voG1vdKx5yb1+MCyoKhnl1fRIRDmTD4BUrLUJevU:FFuMusC0eFcnlxRIlmnwevU

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3852 set thread context of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 3292	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	95
PID 3852 wrote to memory of 3292	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	95
PID 3852 wrote to memory of 3292	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	95
PID 3852 wrote to memory of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96
PID 3852 wrote to memory of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96
PID 3852 wrote to memory of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96
PID 3852 wrote to memory of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96
PID 3852 wrote to memory of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96
PID 3852 wrote to memory of 3904	3852	68c43b3ca349cc9a76a0a0d52be2e53f.exe	96

C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe
"C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe
  "C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe"
  2⤵
  PID:3292
- C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe
  "C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904

memory/3852-139-0x0000000005D70000-0x0000000005E0C000-memory.dmp

Filesize
624KB

Download
memory/3852-133-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/3852-135-0x0000000005FB0000-0x0000000006554000-memory.dmp

Filesize
5.6MB

Download
memory/3852-136-0x0000000005AA0000-0x0000000005B32000-memory.dmp

Filesize
584KB

Download
memory/3852-137-0x0000000005CC0000-0x0000000005CD0000-memory.dmp

Filesize
64KB

Download
memory/3852-138-0x0000000005A30000-0x0000000005A3A000-memory.dmp

Filesize
40KB

Download
memory/3852-134-0x0000000000F60000-0x0000000001028000-memory.dmp

Filesize
800KB

Download
memory/3852-140-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/3852-144-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/3852-141-0x0000000005CC0000-0x0000000005CD0000-memory.dmp

Filesize
64KB

Download
memory/3904-142-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3904-146-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3904-145-0x00000000016C0000-0x0000000001A0A000-memory.dmp

Filesize
3.3MB

Download
memory/3904-147-0x00000000016C0000-0x0000000001A0A000-memory.dmp

Filesize
3.3MB

Download