cb8932abc8615354c90558b8bc7eb63ae3dd607ce41cb70172c6f87564cb6ca6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 20:29

Target

41d6b06dbab79f45bc71832c7c691c16.exe
Size

10KB
MD5

41d6b06dbab79f45bc71832c7c691c16
SHA1

6afc1420c3b8594e1d51b413a19683ec227932bb
SHA256

cb8932abc8615354c90558b8bc7eb63ae3dd607ce41cb70172c6f87564cb6ca6
SHA512

bc51aa60cee34da4ec91fc8c918cbe24415ab27720a5b7888209e7ce0511d873fb9c0229e73388c2681c22ced69754c75b5406e0df835882761c5fc0e90997b9
SSDEEP

192:iEVm3Vy7U2Bm7s4/CdqacfXr+ML71lz4+Q7KB1UzP1oy/3u:bmFy7+PXn7fk+Q7KB1U1V

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2176	update.exe

Loads dropped DLL 4 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 3004	2176	update.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	update.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2176	3064	41d6b06dbab79f45bc71832c7c691c16.exe	28
PID 3064 wrote to memory of 2176	3064	41d6b06dbab79f45bc71832c7c691c16.exe	28
PID 3064 wrote to memory of 2176	3064	41d6b06dbab79f45bc71832c7c691c16.exe	28
PID 3064 wrote to memory of 2176	3064	41d6b06dbab79f45bc71832c7c691c16.exe	28
PID 3064 wrote to memory of 2176	3064	41d6b06dbab79f45bc71832c7c691c16.exe	28
PID 3064 wrote to memory of 2176	3064	41d6b06dbab79f45bc71832c7c691c16.exe	28
PID 3064 wrote to memory of 2176	3064	41d6b06dbab79f45bc71832c7c691c16.exe	28
PID 2176 wrote to memory of 3004	2176	update.exe	29
PID 2176 wrote to memory of 3004	2176	update.exe	29
PID 2176 wrote to memory of 3004	2176	update.exe	29
PID 2176 wrote to memory of 3004	2176	update.exe	29
PID 2176 wrote to memory of 3004	2176	update.exe	29
PID 2176 wrote to memory of 3004	2176	update.exe	29
PID 2176 wrote to memory of 3004	2176	update.exe	29
PID 2176 wrote to memory of 3004	2176	update.exe	29
PID 2176 wrote to memory of 3004	2176	update.exe	29

\ProgramData\update.exe

Filesize
10KB

MD5
41d6b06dbab79f45bc71832c7c691c16

SHA1
6afc1420c3b8594e1d51b413a19683ec227932bb

SHA256
cb8932abc8615354c90558b8bc7eb63ae3dd607ce41cb70172c6f87564cb6ca6

SHA512
bc51aa60cee34da4ec91fc8c918cbe24415ab27720a5b7888209e7ce0511d873fb9c0229e73388c2681c22ced69754c75b5406e0df835882761c5fc0e90997b9

Download Submit
memory/3004-10-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3064-1-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download