5db15b605f6fef05c5ff16a5a293ee2d633dabbc9608e062213805ddd7e5428d

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 03:10

Target

ba5e120b64d88a8a27ee41a45ed5bab9.exe
Size

91KB
MD5

ba5e120b64d88a8a27ee41a45ed5bab9
SHA1

9b2e4962572a0067db68a10e2c537f743683d547
SHA256

5db15b605f6fef05c5ff16a5a293ee2d633dabbc9608e062213805ddd7e5428d
SHA512

b846a8b015c28ed942be3e8ca6b9596eb96c8391ba6606384e6e60397ccff8ab634e11129a35deecc00ad734a1bf3b04ddcd076dd0a3703305b0df2e1d88d06b
SSDEEP

1536:/48MMDo0GsIQFa/lrmsJsi8RbqTapBzCtiQNhDZ6gvZlG4S5x3K4FvRCDZYP5SJO:Q8MF8axJf8FqupBuThcFKEoDuRST8SC

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2172 set thread context of 2492	2172	ba5e120b64d88a8a27ee41a45ed5bab9.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	ba5e120b64d88a8a27ee41a45ed5bab9.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2492	2172	ba5e120b64d88a8a27ee41a45ed5bab9.exe	28
PID 2172 wrote to memory of 2492	2172	ba5e120b64d88a8a27ee41a45ed5bab9.exe	28
PID 2172 wrote to memory of 2492	2172	ba5e120b64d88a8a27ee41a45ed5bab9.exe	28
PID 2172 wrote to memory of 2492	2172	ba5e120b64d88a8a27ee41a45ed5bab9.exe	28
PID 2172 wrote to memory of 2492	2172	ba5e120b64d88a8a27ee41a45ed5bab9.exe	28
PID 2172 wrote to memory of 2492	2172	ba5e120b64d88a8a27ee41a45ed5bab9.exe	28
PID 2172 wrote to memory of 2492	2172	ba5e120b64d88a8a27ee41a45ed5bab9.exe	28
PID 2172 wrote to memory of 2492	2172	ba5e120b64d88a8a27ee41a45ed5bab9.exe	28
PID 2172 wrote to memory of 2492	2172	ba5e120b64d88a8a27ee41a45ed5bab9.exe	28

C:\Users\Admin\AppData\Local\Temp\ba5e120b64d88a8a27ee41a45ed5bab9.exe
"C:\Users\Admin\AppData\Local\Temp\ba5e120b64d88a8a27ee41a45ed5bab9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\ba5e120b64d88a8a27ee41a45ed5bab9.exe
  C:\Users\Admin\AppData\Local\Temp\ba5e120b64d88a8a27ee41a45ed5bab9.exe
  2⤵
  PID:2492

memory/2172-0-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2172-1-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2172-2-0x0000000001F60000-0x0000000001FA0000-memory.dmp

Filesize
256KB

Download
memory/2172-5-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2492-3-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2492-6-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2492-7-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download