3dd7c774004ae61e5bb7303b2be797c43dfbb39d43c27d4257561b5f01782db3

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 17:58

Target

a46cd6a7b40e34d40577c1e0b0d173e4.exe
Size

196KB
MD5

a46cd6a7b40e34d40577c1e0b0d173e4
SHA1

be0394249c2ded68be837dd65c4b8a0184f7aa68
SHA256

3dd7c774004ae61e5bb7303b2be797c43dfbb39d43c27d4257561b5f01782db3
SHA512

93c7d82d4dea602f145b6198c2c1fa55c5bb9ec2ebc8b86b3f5ebfb89d8ea34f866cf2113ecac833162dffe6db976f3c25712b3862a987b8b570c5093eec0af8
SSDEEP

3072:ymromSkSck90GHWhW/+1NHV/iG9om/GEUlGKUmUidR1W5FmVHF4lMknZ9PBAt:ghV0Zb1/rqSGvJUmpdR16cknZ9JG

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
912	a46cd6a7b40e34d40577c1e0b0d173e4.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 912 set thread context of 4440	912	a46cd6a7b40e34d40577c1e0b0d173e4.exe	87
PID 4440 set thread context of 3216	4440	a46cd6a7b40e34d40577c1e0b0d173e4.exe	90

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	a46cd6a7b40e34d40577c1e0b0d173e4.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 4440	912	a46cd6a7b40e34d40577c1e0b0d173e4.exe	87
PID 912 wrote to memory of 4440	912	a46cd6a7b40e34d40577c1e0b0d173e4.exe	87
PID 912 wrote to memory of 4440	912	a46cd6a7b40e34d40577c1e0b0d173e4.exe	87
PID 912 wrote to memory of 4440	912	a46cd6a7b40e34d40577c1e0b0d173e4.exe	87
PID 912 wrote to memory of 4440	912	a46cd6a7b40e34d40577c1e0b0d173e4.exe	87
PID 912 wrote to memory of 4440	912	a46cd6a7b40e34d40577c1e0b0d173e4.exe	87
PID 912 wrote to memory of 4440	912	a46cd6a7b40e34d40577c1e0b0d173e4.exe	87
PID 912 wrote to memory of 4440	912	a46cd6a7b40e34d40577c1e0b0d173e4.exe	87
PID 912 wrote to memory of 4440	912	a46cd6a7b40e34d40577c1e0b0d173e4.exe	87
PID 4440 wrote to memory of 3216	4440	a46cd6a7b40e34d40577c1e0b0d173e4.exe	90
PID 4440 wrote to memory of 3216	4440	a46cd6a7b40e34d40577c1e0b0d173e4.exe	90
PID 4440 wrote to memory of 3216	4440	a46cd6a7b40e34d40577c1e0b0d173e4.exe	90
PID 4440 wrote to memory of 3216	4440	a46cd6a7b40e34d40577c1e0b0d173e4.exe	90
PID 4440 wrote to memory of 3216	4440	a46cd6a7b40e34d40577c1e0b0d173e4.exe	90
PID 4440 wrote to memory of 3216	4440	a46cd6a7b40e34d40577c1e0b0d173e4.exe	90
PID 4440 wrote to memory of 3216	4440	a46cd6a7b40e34d40577c1e0b0d173e4.exe	90
PID 4440 wrote to memory of 3216	4440	a46cd6a7b40e34d40577c1e0b0d173e4.exe	90

C:\Users\Admin\AppData\Local\Temp\vmEd2bdaVAiflgWSjhah36a.tmp

Filesize
3KB

MD5
c90cb999a81e4ec1acc46e32ec7096fe

SHA1
8ea6d6f89d22b15ad21aae205429e01b7b488dc3

SHA256
7041302235afb47611b5ab0d6563b09772ca085efe405937bdbf04971b8a852d

SHA512
7556eb8d14cc365a88a6fa1020a581335e99ebfffb81dde7d3c2dea51ddef47981825caa2b805a40933167f28872d5421d5510bc18efa3e73e310e4559c3b13a

Download Submit
memory/3216-8-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3216-13-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3216-14-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3216-15-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4440-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4440-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4440-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download