ba9e517cce8864d6e930df232cb321c2583d440457114b91014fe5861ae8ebb7

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 08:28

Target

136a7629072160992f8fe69685ac9483.exe
Size

44KB
MD5

136a7629072160992f8fe69685ac9483
SHA1

c8be225a6b2558c0ef5b8b7d1e5ed0a4045ad194
SHA256

ba9e517cce8864d6e930df232cb321c2583d440457114b91014fe5861ae8ebb7
SHA512

89cae869c4e3304a17e3333229cd6f2fb3d8c1ec668d2b0971636122e9d9b519a38967492290fc3697b8bb30ed0524bbb4fd3f7448b1746fb6c59ccef100e969
SSDEEP

192:J+mhimeFryCnRYLipFM+VcI9zAhgAegtj9tDCSk0/0AxmgQQ9Wmcrl6/k/7RjGbH:lY/ryOWKeI9FAeW3CdgdcPBfUL2x2afC

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ICSAgent.exe	136a7629072160992f8fe69685ac9483.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1928 set thread context of 1700	1928	136a7629072160992f8fe69685ac9483.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	1700	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1928	136a7629072160992f8fe69685ac9483.exe
Token: SeBackupPrivilege	1928	136a7629072160992f8fe69685ac9483.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1928	136a7629072160992f8fe69685ac9483.exe
1928	136a7629072160992f8fe69685ac9483.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1700	1928	136a7629072160992f8fe69685ac9483.exe	28
PID 1928 wrote to memory of 1700	1928	136a7629072160992f8fe69685ac9483.exe	28
PID 1928 wrote to memory of 1700	1928	136a7629072160992f8fe69685ac9483.exe	28
PID 1928 wrote to memory of 1700	1928	136a7629072160992f8fe69685ac9483.exe	28
PID 1928 wrote to memory of 1700	1928	136a7629072160992f8fe69685ac9483.exe	28
PID 1928 wrote to memory of 1700	1928	136a7629072160992f8fe69685ac9483.exe	28
PID 1700 wrote to memory of 1052	1700	136a7629072160992f8fe69685ac9483.exe	29
PID 1700 wrote to memory of 1052	1700	136a7629072160992f8fe69685ac9483.exe	29
PID 1700 wrote to memory of 1052	1700	136a7629072160992f8fe69685ac9483.exe	29
PID 1700 wrote to memory of 1052	1700	136a7629072160992f8fe69685ac9483.exe	29

memory/1700-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1700-3-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download