02a29d49a2c5c9759bc2c98b2bc782c641f002c7b26fff35e247acbe4b7a244c

Analysis

max time kernel
111s
max time network
30s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 01:08

Target

3f8375d365a92a2241855a5027e8e7c1.exe
Size

282KB
MD5

3f8375d365a92a2241855a5027e8e7c1
SHA1

63b8238cb0d22ce37f85fb6b8b7648e4a29c65a9
SHA256

02a29d49a2c5c9759bc2c98b2bc782c641f002c7b26fff35e247acbe4b7a244c
SHA512

e91c6312b279b533283b972ee8d77fb8f9357f1a12b57d90d5a3fa2d3ea84690c359c1f0965417a97c9a075b48f855b5722a86a760943c6e49de4632a478fbad
SSDEEP

6144:ozppykBHHZ1ILn3/fqpeq6u/tv6tB6vdu8xIKLazQ:ozyQ1ILPfi0ud4B6vduCIKLa8

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2580 set thread context of 1736	2580	3f8375d365a92a2241855a5027e8e7c1.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	3f8375d365a92a2241855a5027e8e7c1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1736	2580	3f8375d365a92a2241855a5027e8e7c1.exe	29
PID 2580 wrote to memory of 1736	2580	3f8375d365a92a2241855a5027e8e7c1.exe	29
PID 2580 wrote to memory of 1736	2580	3f8375d365a92a2241855a5027e8e7c1.exe	29
PID 2580 wrote to memory of 1736	2580	3f8375d365a92a2241855a5027e8e7c1.exe	29
PID 2580 wrote to memory of 1736	2580	3f8375d365a92a2241855a5027e8e7c1.exe	29
PID 2580 wrote to memory of 1736	2580	3f8375d365a92a2241855a5027e8e7c1.exe	29
PID 2580 wrote to memory of 1736	2580	3f8375d365a92a2241855a5027e8e7c1.exe	29
PID 2580 wrote to memory of 1736	2580	3f8375d365a92a2241855a5027e8e7c1.exe	29

C:\Users\Admin\AppData\Local\Temp\3f8375d365a92a2241855a5027e8e7c1.exe
"C:\Users\Admin\AppData\Local\Temp\3f8375d365a92a2241855a5027e8e7c1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\3f8375d365a92a2241855a5027e8e7c1.exe
  C:\Users\Admin\AppData\Local\Temp\3f8375d365a92a2241855a5027e8e7c1.exe
  2⤵
  PID:1736

memory/1736-5-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1736-7-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1736-9-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1736-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1736-13-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2580-0-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/2580-1-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/2580-2-0x00000000001F0000-0x0000000000230000-memory.dmp

Filesize
256KB

Download
memory/2580-3-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/2580-4-0x00000000001F0000-0x0000000000230000-memory.dmp

Filesize
256KB

Download
memory/2580-15-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download