c6ff402225f5d53a08b8bdac4f6a21c91954f0bf8084b25d018e994cb5367b97

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 09:56

Target
1bafac6637f3bb17204b346f479409d5.exe
Size 842KB
Sample240101-lyrd9abac2
SHA256 c6ff402225f5d53a08b8bdac4f6a21c91954f0bf8084b25d018e994cb5367b97
MD5 1bafac6637f3bb17204b346f479409d5
SHA1 afa4a547aac220c213c6e64b73220976b3be17a3
SHA512 0d1d6fe753abd553b079747621f95faa7d0c8822d68e0fb66be8fdf934edd4c8a687c4c94f3d8e3d40985fb6c52692a9942862c117d76a0e2525c839ca49310e
SSDEEP 12288:OdUc6HpmFXSgD3YT/5paA+r0TBmLIU80ZOC6:EM8FXSgDm5fYMmLIQO5
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3948 set thread context of 5028	3948	1bafac6637f3bb17204b346f479409d5.exe	103

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	1bafac6637f3bb17204b346f479409d5.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 4392	3948	1bafac6637f3bb17204b346f479409d5.exe	102
PID 3948 wrote to memory of 4392	3948	1bafac6637f3bb17204b346f479409d5.exe	102
PID 3948 wrote to memory of 4392	3948	1bafac6637f3bb17204b346f479409d5.exe	102
PID 3948 wrote to memory of 5028	3948	1bafac6637f3bb17204b346f479409d5.exe	103
PID 3948 wrote to memory of 5028	3948	1bafac6637f3bb17204b346f479409d5.exe	103
PID 3948 wrote to memory of 5028	3948	1bafac6637f3bb17204b346f479409d5.exe	103
PID 3948 wrote to memory of 5028	3948	1bafac6637f3bb17204b346f479409d5.exe	103
PID 3948 wrote to memory of 5028	3948	1bafac6637f3bb17204b346f479409d5.exe	103
PID 3948 wrote to memory of 5028	3948	1bafac6637f3bb17204b346f479409d5.exe	103

C:\Users\Admin\AppData\Local\Temp\1bafac6637f3bb17204b346f479409d5.exe
"C:\Users\Admin\AppData\Local\Temp\1bafac6637f3bb17204b346f479409d5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\1bafac6637f3bb17204b346f479409d5.exe
  "{path}"
  2⤵
  PID:4392
- C:\Users\Admin\AppData\Local\Temp\1bafac6637f3bb17204b346f479409d5.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028

memory/3948-0-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/3948-2-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/3948-1-0x0000000000910000-0x0000000000920000-memory.dmp

Download

memory/3948-3-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/3948-4-0x0000000000910000-0x0000000000920000-memory.dmp

Download

memory/3948-7-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/5028-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5028-8-0x0000000001550000-0x000000000189A000-memory.dmp

Download

memory/5028-9-0x0000000001550000-0x000000000189A000-memory.dmp

Download