0674e51d31361faca47a27614769d2299549daae341749a712b5f4b36da85f29

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2023 01:13

Target

7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
Size

711KB
MD5

254f2b0822d915db93df95571ab74093
SHA1

25da96864584dea6e5376857baac56dddd52b254
SHA256

7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b
SHA512

ab78be667aca55163ca9fc44ef077047d1ce45c8a86f45cfc4da1303177cee2902cf9c51d0a4d5f8decba7ab8759bb32ddb72579798d1dec0b60086fa622d4f9
SSDEEP

12288:Q2iNsXDl+C1Gm+z0xtyTD/+py9vsKi+MxeWCjVqG/AO3XsTWiVRe3tRhdyLH:Q1gRGm+zv7+qvRMxeT3K3VWhdyLH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 2036	2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	90

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2036	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
2036	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2036	2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	90
PID 2000 wrote to memory of 2036	2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	90
PID 2000 wrote to memory of 2036	2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	90
PID 2000 wrote to memory of 2036	2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	90
PID 2000 wrote to memory of 2036	2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	90
PID 2000 wrote to memory of 2036	2000	7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe	90

C:\Users\Admin\AppData\Local\Temp\7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
"C:\Users\Admin\AppData\Local\Temp\7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe
  "C:\Users\Admin\AppData\Local\Temp\7bf46bf16be075a6c263a2e12339a9a01c96d933eb61b474002144bf7c7cc73b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036

memory/2000-139-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/2000-133-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/2000-135-0x00000000057F0000-0x0000000005D94000-memory.dmp

Filesize
5.6MB

Download
memory/2000-136-0x00000000052E0000-0x0000000005372000-memory.dmp

Filesize
584KB

Download
memory/2000-137-0x0000000005290000-0x00000000052A0000-memory.dmp

Filesize
64KB

Download
memory/2000-138-0x00000000052A0000-0x00000000052AA000-memory.dmp

Filesize
40KB

Download
memory/2000-134-0x00000000007D0000-0x0000000000888000-memory.dmp

Filesize
736KB

Download
memory/2000-140-0x0000000005290000-0x00000000052A0000-memory.dmp

Filesize
64KB

Download
memory/2000-141-0x00000000097C0000-0x000000000985C000-memory.dmp

Filesize
624KB

Download
memory/2000-144-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/2036-142-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2036-145-0x0000000001990000-0x0000000001CDA000-memory.dmp

Filesize
3.3MB

Download
memory/2036-146-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download