b91279d3d95a6c306d9450bc6a2167cfac17648ade678c901631738fe86d0571

Analysis

max time kernel
182s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 02:44

Target

3baf5ae654efe9636dbbcbaff9fd5c51.exe
Size

241KB
MD5

3baf5ae654efe9636dbbcbaff9fd5c51
SHA1

32ef66cde00e45151f0bedb054ca6fdc3788b7d4
SHA256

b91279d3d95a6c306d9450bc6a2167cfac17648ade678c901631738fe86d0571
SHA512

d14a548c5b589cf7dec64c1c0189d3ff59de15db87aefecad06eb2d60a17105425a32a85bee2a2569a579fce15c4d125e7d7a4b9589431064fb92c351b6e9000
SSDEEP

6144:JpsWKqzagpWmNwhb9H7S5PjqfvXRPVu5oKrd7h9F42du+jDjIZN:3Hda7mNOH7S9qabr5h9FSy

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3904	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4128 set thread context of 3904	4128	3baf5ae654efe9636dbbcbaff9fd5c51.exe	93

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	3baf5ae654efe9636dbbcbaff9fd5c51.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3904	4128	3baf5ae654efe9636dbbcbaff9fd5c51.exe	93
PID 4128 wrote to memory of 3904	4128	3baf5ae654efe9636dbbcbaff9fd5c51.exe	93
PID 4128 wrote to memory of 3904	4128	3baf5ae654efe9636dbbcbaff9fd5c51.exe	93
PID 4128 wrote to memory of 3904	4128	3baf5ae654efe9636dbbcbaff9fd5c51.exe	93

C:\Users\Admin\AppData\Local\Temp\3baf5ae654efe9636dbbcbaff9fd5c51.exe
"C:\Users\Admin\AppData\Local\Temp\3baf5ae654efe9636dbbcbaff9fd5c51.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:3904

memory/4128-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4128-2-0x0000000002080000-0x00000000020DE000-memory.dmp

Filesize
376KB

Download
memory/4128-1-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4128-3-0x0000000002083000-0x0000000002084000-memory.dmp

Filesize
4KB

Download
memory/4128-4-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4128-5-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4128-6-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4128-8-0x0000000002080000-0x00000000020DE000-memory.dmp

Filesize
376KB

Download