0674e51d31361faca47a27614769d2299549daae341749a712b5f4b36da85f29

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/08/2023, 01:13

Target

7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
Size

711KB
MD5

254f2b0822d915db93df95571ab74093
SHA1

25da96864584dea6e5376857baac56dddd52b254
SHA256

7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b
SHA512

ab78be667aca55163ca9fc44ef077047d1ce45c8a86f45cfc4da1303177cee2902cf9c51d0a4d5f8decba7ab8759bb32ddb72579798d1dec0b60086fa622d4f9
SSDEEP

12288:Q2iNsXDl+C1Gm+z0xtyTD/+py9vsKi+MxeWCjVqG/AO3XsTWiVRe3tRhdyLH:Q1gRGm+zv7+qvRMxeT3K3VWhdyLH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2908 set thread context of 3044	2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	30

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
3044	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3044	2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	30
PID 2908 wrote to memory of 3044	2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	30
PID 2908 wrote to memory of 3044	2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	30
PID 2908 wrote to memory of 3044	2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	30
PID 2908 wrote to memory of 3044	2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	30
PID 2908 wrote to memory of 3044	2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	30
PID 2908 wrote to memory of 3044	2908	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	30

C:\Users\Admin\AppData\Local\Temp\7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
"C:\Users\Admin\AppData\Local\Temp\7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
  "C:\Users\Admin\AppData\Local\Temp\7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044

memory/2908-67-0x0000000074300000-0x00000000749EE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-61-0x0000000005700000-0x0000000005774000-memory.dmp

Filesize
464KB

Download
memory/2908-56-0x0000000002170000-0x00000000021B0000-memory.dmp

Filesize
256KB

Download
memory/2908-57-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2908-58-0x0000000074300000-0x00000000749EE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-59-0x0000000002170000-0x00000000021B0000-memory.dmp

Filesize
256KB

Download
memory/2908-55-0x0000000074300000-0x00000000749EE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-60-0x0000000000A40000-0x0000000000A4E000-memory.dmp

Filesize
56KB

Download
memory/2908-54-0x0000000000A60000-0x0000000000B18000-memory.dmp

Filesize
736KB

Download
memory/3044-63-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3044-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3044-66-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3044-62-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3044-69-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3044-68-0x0000000000B20000-0x0000000000E23000-memory.dmp

Filesize
3.0MB

Download
memory/3044-70-0x0000000000B20000-0x0000000000E23000-memory.dmp

Filesize
3.0MB

Download