16fbabbe3842fee9262fd42da0151f81e4375652d59b01f75a1f0dff46cda69f

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 11:20

Target

met.exe
Size

1.2MB
MD5

a8558d6b6d80af8d991a468bb1b4b2b5
SHA1

f9416cb8e7535643f86c5a3540642fe0fb0b09d0
SHA256

16fbabbe3842fee9262fd42da0151f81e4375652d59b01f75a1f0dff46cda69f
SHA512

5e2938735a9d429acda33a2c4c30c07131df13ad62360db897bb178988471457cc0b2d4a046c31f6b6d1794331abd90112d5b9285b02956ba2479aaea181fc7f
SSDEEP

6144:4AFObyV0RWeTKO40HAOWZ4s+H1CCZnvYO6yq2u8erIUfc:VsbyGHTq0kZ3aNZnvYWJuv1fc

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2512 set thread context of 2056	2512	met.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2056	InstallUtil.exe
2056	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2056	2512	met.exe	29
PID 2512 wrote to memory of 2056	2512	met.exe	29
PID 2512 wrote to memory of 2056	2512	met.exe	29
PID 2512 wrote to memory of 2056	2512	met.exe	29
PID 2512 wrote to memory of 2056	2512	met.exe	29
PID 2512 wrote to memory of 2056	2512	met.exe	29
PID 2512 wrote to memory of 2056	2512	met.exe	29
PID 2512 wrote to memory of 2056	2512	met.exe	29
PID 2512 wrote to memory of 2056	2512	met.exe	29
PID 2512 wrote to memory of 2056	2512	met.exe	29
PID 2512 wrote to memory of 2056	2512	met.exe	29
PID 2512 wrote to memory of 2056	2512	met.exe	29

memory/2056-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2056-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2056-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2056-5-0x00000000746E0000-0x0000000074DCE000-memory.dmp

Filesize
6.9MB

Download
memory/2056-6-0x00000000005F0000-0x0000000000630000-memory.dmp

Filesize
256KB

Download
memory/2056-7-0x00000000746E0000-0x0000000074DCE000-memory.dmp

Filesize
6.9MB

Download
memory/2056-8-0x00000000746E0000-0x0000000074DCE000-memory.dmp

Filesize
6.9MB

Download