c2eb5ae05ebcfe92da148472d1a6c7098d3dab3f3c57153a3fb83c48128cb14e

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 02:58

Target

aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe
Size

918KB
MD5

b4746838dc731451d28d7480f981f4df
SHA1

ec133378a88d8ad76a2ca9db01bade15463d361a
SHA256

aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95
SHA512

b33df62a400f29d3429e032447c71d750ec4399df026ae03f96961b11f747c9a1b5d61603a467193491964e126378f2e1e66ad4e3990cd27afb01d9fd637cf77
SSDEEP

24576:um5eFkOPhJUpaKycyYJAjbaGPASdlsaTzeM/:um5XqJUpXy95SGdlb

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 2772	1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	2772	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe
1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe
1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe
1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe
1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe
1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe
1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe
2772	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2772	1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe	28
PID 1792 wrote to memory of 2772	1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe	28
PID 1792 wrote to memory of 2772	1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe	28
PID 1792 wrote to memory of 2772	1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe	28
PID 1792 wrote to memory of 2772	1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe	28
PID 1792 wrote to memory of 2772	1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe	28
PID 1792 wrote to memory of 2772	1792	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe	28
PID 2772 wrote to memory of 2968	2772	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe	29
PID 2772 wrote to memory of 2968	2772	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe	29
PID 2772 wrote to memory of 2968	2772	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe	29
PID 2772 wrote to memory of 2968	2772	aa7afebfd032006687eddefc5578bbc1933f1477aeaef5a17427677a4de08d95.exe	29

memory/1792-6-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/1792-7-0x0000000002280000-0x00000000022C0000-memory.dmp

Filesize
256KB

Download
memory/1792-2-0x0000000002280000-0x00000000022C0000-memory.dmp

Filesize
256KB

Download
memory/1792-3-0x0000000000490000-0x00000000004A6000-memory.dmp

Filesize
88KB

Download
memory/1792-4-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/1792-5-0x0000000005130000-0x00000000051AE000-memory.dmp

Filesize
504KB

Download
memory/1792-1-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/1792-15-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/1792-0-0x0000000000B40000-0x0000000000C2A000-memory.dmp

Filesize
936KB

Download
memory/2772-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2772-8-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2772-14-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2772-10-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2772-16-0x0000000000780000-0x0000000000A83000-memory.dmp

Filesize
3.0MB

Download
memory/2772-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download