f8da8602218c2e89f7f1688a471f4d73cd2255fa6f4d79891ac4743273dc0feb

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 18:03

Target

6848ee66ec78d5a7f2fd72a75f15f0ee.exe
Size

57KB
MD5

6848ee66ec78d5a7f2fd72a75f15f0ee
SHA1

810bb6edb904b4c8fff7513455f681c1e39bebb1
SHA256

f8da8602218c2e89f7f1688a471f4d73cd2255fa6f4d79891ac4743273dc0feb
SHA512

c85ecaf5506acac9c6fe33b3cdb42ac375a3b5b8bab849496799872e3f3ca1bb6925e4ec4b8a531f640f0076a11ae9a6657ac6c5cc70cc8032e3c0c77b217ae2
SSDEEP

1536:O5DfneWJ/JSgHDs1Aov788o7PC5XOcSptZSvs3EfcVhmBvr7:O1fneg/J5HVozj2SOcSptnEfghmF7

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4692 set thread context of 4380	4692	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	31

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	6848ee66ec78d5a7f2fd72a75f15f0ee.exe
Token: SeManageVolumePrivilege	3300	svchost.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4380	4692	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	31
PID 4692 wrote to memory of 4380	4692	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	31
PID 4692 wrote to memory of 4380	4692	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	31
PID 4692 wrote to memory of 4380	4692	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	31
PID 4692 wrote to memory of 4380	4692	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	31
PID 4692 wrote to memory of 4380	4692	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	31
PID 4692 wrote to memory of 4380	4692	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	31
PID 4380 wrote to memory of 3488	4380	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	49
PID 4380 wrote to memory of 3488	4380	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	49
PID 4380 wrote to memory of 3488	4380	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	49
PID 4380 wrote to memory of 3488	4380	6848ee66ec78d5a7f2fd72a75f15f0ee.exe	49

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3300

memory/3300-31-0x000001E5FB840000-0x000001E5FB850000-memory.dmp

Filesize
64KB

Download
memory/3300-51-0x000001E5FFCC0000-0x000001E5FFCC1000-memory.dmp

Filesize
4KB

Download
memory/3300-50-0x000001E5FFBB0000-0x000001E5FFBB1000-memory.dmp

Filesize
4KB

Download
memory/3300-49-0x000001E5FFBB0000-0x000001E5FFBB1000-memory.dmp

Filesize
4KB

Download
memory/3300-47-0x000001E5FFB80000-0x000001E5FFB81000-memory.dmp

Filesize
4KB

Download
memory/3488-11-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3488-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4380-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4380-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4380-14-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4380-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4380-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4692-1-0x00000000009A0000-0x00000000009B0000-memory.dmp

Filesize
64KB

Download
memory/4692-8-0x0000000074A80000-0x0000000075031000-memory.dmp

Filesize
5.7MB

Download
memory/4692-0-0x0000000074A80000-0x0000000075031000-memory.dmp

Filesize
5.7MB

Download
memory/4692-2-0x0000000074A80000-0x0000000075031000-memory.dmp

Filesize
5.7MB

Download