61685bf49ea8cc02b27f790314d4eb3c0c3d36f6a77a121696d5e9f101ea1874

Analysis

max time kernel
137s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 04:31

Target

3fe6a311a1609160a9506e4855bf1cf4.exe
Size

128KB
MD5

3fe6a311a1609160a9506e4855bf1cf4
SHA1

fd838a6251580aa4c2e9f742c7dd530531fb8e42
SHA256

61685bf49ea8cc02b27f790314d4eb3c0c3d36f6a77a121696d5e9f101ea1874
SHA512

1cf59ba2c7e373ffe7dc3e4b3bac29d71075e0e99053a0c75d0063e304938d99e056748def0b9ef084519d38e4ed30162b502157d0e07f185b4536d7a3f4c632
SSDEEP

3072:qeObCoVS4mVb926EhWUxms0fhKZHil8cgWN5CXfASOvvdM:qnbCoVlHjmsI2E8cx22vv

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process
PID 940 set thread context of 0	940	3fe6a311a1609160a9506e4855bf1cf4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	3fe6a311a1609160a9506e4855bf1cf4.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4084	940	3fe6a311a1609160a9506e4855bf1cf4.exe	100
PID 940 wrote to memory of 4084	940	3fe6a311a1609160a9506e4855bf1cf4.exe	100
PID 940 wrote to memory of 4084	940	3fe6a311a1609160a9506e4855bf1cf4.exe	100
PID 940 wrote to memory of 4084	940	3fe6a311a1609160a9506e4855bf1cf4.exe	100
PID 940 wrote to memory of 4084	940	3fe6a311a1609160a9506e4855bf1cf4.exe	100
PID 940 wrote to memory of 4084	940	3fe6a311a1609160a9506e4855bf1cf4.exe	100

C:\Users\Admin\AppData\Local\Temp\3fe6a311a1609160a9506e4855bf1cf4.exe
"C:\Users\Admin\AppData\Local\Temp\3fe6a311a1609160a9506e4855bf1cf4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Users\Admin\AppData\Local\Temp\3fe6a311a1609160a9506e4855bf1cf4.exe
  "C:\Users\Admin\AppData\Local\Temp\3fe6a311a1609160a9506e4855bf1cf4.exe"
  2⤵
  PID:4084

memory/940-0-0x00007FFCA7C40000-0x00007FFCA85E1000-memory.dmp

Filesize
9.6MB

Download
memory/940-1-0x00007FFCA7C40000-0x00007FFCA85E1000-memory.dmp

Filesize
9.6MB

Download
memory/940-2-0x00000000013B0000-0x00000000013C0000-memory.dmp

Filesize
64KB

Download
memory/940-3-0x00007FFCA7C40000-0x00007FFCA85E1000-memory.dmp

Filesize
9.6MB

Download
memory/940-4-0x00007FFCA7C40000-0x00007FFCA85E1000-memory.dmp

Filesize
9.6MB

Download
memory/940-5-0x00000000013B0000-0x00000000013C0000-memory.dmp

Filesize
64KB

Download
memory/940-6-0x000000001BA90000-0x000000001BB80000-memory.dmp

Filesize
960KB

Download
memory/940-7-0x0000000001010000-0x000000000102E000-memory.dmp

Filesize
120KB

Download
memory/940-8-0x00000000010B0000-0x00000000010BC000-memory.dmp

Filesize
48KB

Download
memory/940-9-0x000000001C550000-0x000000001CA1E000-memory.dmp

Filesize
4.8MB

Download
memory/940-10-0x000000001CAC0000-0x000000001CB5C000-memory.dmp

Filesize
624KB

Download
memory/940-11-0x00000000013B0000-0x00000000013C0000-memory.dmp

Filesize
64KB

Download
memory/940-13-0x00007FFCA7C40000-0x00007FFCA85E1000-memory.dmp

Filesize
9.6MB

Download