3deccacfb0a387c136e7cc11b7911ac722974691b4049bfefbae196bc1434055

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 12:15

Target

6dbdba6bb0de308e700b205f31c0f4fa.exe
Size

174KB
MD5

6dbdba6bb0de308e700b205f31c0f4fa
SHA1

2e1544ed2d02bac610c8506521e20c629bffffa7
SHA256

3deccacfb0a387c136e7cc11b7911ac722974691b4049bfefbae196bc1434055
SHA512

792aaeb46de735db1d565f094409a3b84a9e7df1c351b238f68e965410d2a462e87877971393c2a7f13730c57119fed2489b5946fd9d26e1db4101c27e9a6e43
SSDEEP

3072:bjOeJoRFNWqQ1CWwONyNnpVkQVXSxFxPDsMnsPRlqpah:3yBjZkFx7sM0zoi

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2652 set thread context of 2844	2652	6dbdba6bb0de308e700b205f31c0f4fa.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	6dbdba6bb0de308e700b205f31c0f4fa.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2844	2652	6dbdba6bb0de308e700b205f31c0f4fa.exe	28
PID 2652 wrote to memory of 2844	2652	6dbdba6bb0de308e700b205f31c0f4fa.exe	28
PID 2652 wrote to memory of 2844	2652	6dbdba6bb0de308e700b205f31c0f4fa.exe	28
PID 2652 wrote to memory of 2844	2652	6dbdba6bb0de308e700b205f31c0f4fa.exe	28
PID 2652 wrote to memory of 2844	2652	6dbdba6bb0de308e700b205f31c0f4fa.exe	28
PID 2652 wrote to memory of 2844	2652	6dbdba6bb0de308e700b205f31c0f4fa.exe	28
PID 2652 wrote to memory of 2844	2652	6dbdba6bb0de308e700b205f31c0f4fa.exe	28

C:\Users\Admin\AppData\Local\Temp\6dbdba6bb0de308e700b205f31c0f4fa.exe
"C:\Users\Admin\AppData\Local\Temp\6dbdba6bb0de308e700b205f31c0f4fa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\6dbdba6bb0de308e700b205f31c0f4fa.exe
  C:\Users\Admin\AppData\Local\Temp\6dbdba6bb0de308e700b205f31c0f4fa.exe
  2⤵
  PID:2844

memory/2652-0-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/2652-1-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/2652-2-0x0000000002090000-0x00000000020D0000-memory.dmp

Filesize
256KB

Download
memory/2652-10-0x0000000074700000-0x0000000074CAB000-memory.dmp

Filesize
5.7MB

Download
memory/2844-3-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2844-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2844-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2844-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2844-9-0x0000000000310000-0x0000000000310000-memory.dmp

Download