d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27/11/2023, 16:58

Target

d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
Size

608KB
MD5

a91a8edf24d47caa5467f0edc250d0ff
SHA1

98041ec6166c2966f676cbc8a1f1d42fec947c00
SHA256

d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e
SHA512

0dac8878aaf2abe4e20f3884c0ffcff78150898d807468d152e207e439ff6516f98ac7f370fab34f5c2e285c2e1bcccbfd918430ca1b55997d54d279a50a534c
SSDEEP

12288:x4Vv6NZVslFs1JABNmJ4lnZxGA7sRLwQz8XdgTDdik5dCNd:6CvVsoABNmWnmA7sRLwjeTxrUd

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 2620	2412	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	30

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2620	2412	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	30
PID 2412 wrote to memory of 2620	2412	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	30
PID 2412 wrote to memory of 2620	2412	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	30
PID 2412 wrote to memory of 2620	2412	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	30
PID 2412 wrote to memory of 2620	2412	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	30
PID 2412 wrote to memory of 2620	2412	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	30
PID 2412 wrote to memory of 2620	2412	d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe	30

C:\Users\Admin\AppData\Local\Temp\d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
"C:\Users\Admin\AppData\Local\Temp\d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe
  "C:\Users\Admin\AppData\Local\Temp\d45e79dad9202c1ff02f089203e68b1b28e96c02437323a59a21dc1249b1750e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620

memory/2412-8-0x0000000005000000-0x0000000005074000-memory.dmp

Filesize
464KB

Download
memory/2412-14-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2412-2-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download
memory/2412-3-0x0000000000230000-0x0000000000242000-memory.dmp

Filesize
72KB

Download
memory/2412-4-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2412-5-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download
memory/2412-0-0x0000000000DB0000-0x0000000000E4E000-memory.dmp

Filesize
632KB

Download
memory/2412-6-0x00000000002A0000-0x00000000002A8000-memory.dmp

Filesize
32KB

Download
memory/2412-1-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2412-7-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/2620-9-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2620-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2620-13-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2620-10-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2620-15-0x0000000000950000-0x0000000000C53000-memory.dmp

Filesize
3.0MB

Download
memory/2620-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download