ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
08/08/2023, 13:37

Target

ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe
Size

706KB
MD5

90d13a35138fd4954554855ac8a3c350
SHA1

6fc1d502029e8fe0d6c49b257c1e640bc16eecd5
SHA256

ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc
SHA512

faaaba6836c4cad80914782e94074af9e08b9ca24c70f0ba4115d1845eef73fbc3e36e939ab4a2dde4199b6719a8e77a114f53f97207705d851a02d149dd99a9
SSDEEP

12288:b7UZnP7JZP0+oKbAGxmFlccmFepgu6DLxtOXzd04+uB4Hkrplgen2mUpEE:sZP06Xx1puqLxtaB/lD2mg

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1788 set thread context of 2116	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	31

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe
2116	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1724	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	30
PID 1788 wrote to memory of 1724	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	30
PID 1788 wrote to memory of 1724	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	30
PID 1788 wrote to memory of 1724	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	30
PID 1788 wrote to memory of 2116	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	31
PID 1788 wrote to memory of 2116	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	31
PID 1788 wrote to memory of 2116	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	31
PID 1788 wrote to memory of 2116	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	31
PID 1788 wrote to memory of 2116	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	31
PID 1788 wrote to memory of 2116	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	31
PID 1788 wrote to memory of 2116	1788	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	31

C:\Users\Admin\AppData\Local\Temp\ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe
"C:\Users\Admin\AppData\Local\Temp\ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe
  "C:\Users\Admin\AppData\Local\Temp\ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe"
  2⤵
  PID:1724
- C:\Users\Admin\AppData\Local\Temp\ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe
  "C:\Users\Admin\AppData\Local\Temp\ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116

memory/1788-68-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/1788-60-0x00000000057D0000-0x000000000584A000-memory.dmp

Filesize
488KB

Download
memory/1788-55-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/1788-56-0x00000000002A0000-0x00000000002AC000-memory.dmp

Filesize
48KB

Download
memory/1788-57-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/1788-58-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/1788-54-0x0000000000900000-0x00000000009B6000-memory.dmp

Filesize
728KB

Download
memory/1788-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1788-53-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2116-63-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2116-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2116-67-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2116-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2116-70-0x0000000000C90000-0x0000000000F93000-memory.dmp

Filesize
3.0MB

Download
memory/2116-69-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2116-71-0x0000000000C90000-0x0000000000F93000-memory.dmp

Filesize
3.0MB

Download