f8da8602218c2e89f7f1688a471f4d73cd2255fa6f4d79891ac4743273dc0feb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 18:03

Target

6848ee66ec78d5a7f2fd72a75f15f0ee.exe
Size

57KB
MD5

6848ee66ec78d5a7f2fd72a75f15f0ee
SHA1

810bb6edb904b4c8fff7513455f681c1e39bebb1
SHA256

f8da8602218c2e89f7f1688a471f4d73cd2255fa6f4d79891ac4743273dc0feb
SHA512

c85ecaf5506acac9c6fe33b3cdb42ac375a3b5b8bab849496799872e3f3ca1bb6925e4ec4b8a531f640f0076a11ae9a6657ac6c5cc70cc8032e3c0c77b217ae2
SSDEEP

1536:O5DfneWJ/JSgHDs1Aov788o7PC5XOcSptZSvs3EfcVhmBvr7:O1fneg/J5HVozj2SOcSptnEfghmF7

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 1936	2268	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1936	6848ee66ec78d5a7f2fd72a75f15f0ee.exe
1936	6848ee66ec78d5a7f2fd72a75f15f0ee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	6848ee66ec78d5a7f2fd72a75f15f0ee.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1936	2268	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	28
PID 2268 wrote to memory of 1936	2268	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	28
PID 2268 wrote to memory of 1936	2268	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	28
PID 2268 wrote to memory of 1936	2268	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	28
PID 2268 wrote to memory of 1936	2268	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	28
PID 2268 wrote to memory of 1936	2268	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	28
PID 2268 wrote to memory of 1936	2268	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	28
PID 2268 wrote to memory of 1936	2268	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	28
PID 1936 wrote to memory of 1304	1936	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	10
PID 1936 wrote to memory of 1304	1936	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	10
PID 1936 wrote to memory of 1304	1936	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	10
PID 1936 wrote to memory of 1304	1936	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	10

memory/1304-8-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1304-12-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1936-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1936-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1936-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1936-11-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2268-0-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/2268-1-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/2268-2-0x0000000001FE0000-0x0000000002020000-memory.dmp

Filesize
256KB

Download
memory/2268-6-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download