4769d8b513e7bdea0a1b93863da24e89cc5dffa1864ad2c34a4f87976f0e203c

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 09:49

Target

c8518eded0779e65a8b09b4c0ff35f21.exe
Size

217KB
MD5

c8518eded0779e65a8b09b4c0ff35f21
SHA1

96a8f75aa8dde1ec7b398c78973b4a1c90fd3c58
SHA256

4769d8b513e7bdea0a1b93863da24e89cc5dffa1864ad2c34a4f87976f0e203c
SHA512

47d64b10e7d5c974e5441ac6e00480720e0f3f6a181165464c8c6a9ca57be25af8f6def85e5b070e748ecdf9af0311c8f026391531b40de4d9af32807308cc35
SSDEEP

3072:TAuiq7KEgtW+yClLsH8AWauWZv3ID+BFo3Nj/r6f4e8RN6hSklVYqxFV9GqpYuo2:z7KFE+VVg5RcNLmhlVZ6qpYuoCwROr

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2844 set thread context of 2648	2844	c8518eded0779e65a8b09b4c0ff35f21.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2648	c8518eded0779e65a8b09b4c0ff35f21.exe
2648	c8518eded0779e65a8b09b4c0ff35f21.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	c8518eded0779e65a8b09b4c0ff35f21.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2648	2844	c8518eded0779e65a8b09b4c0ff35f21.exe	28
PID 2844 wrote to memory of 2648	2844	c8518eded0779e65a8b09b4c0ff35f21.exe	28
PID 2844 wrote to memory of 2648	2844	c8518eded0779e65a8b09b4c0ff35f21.exe	28
PID 2844 wrote to memory of 2648	2844	c8518eded0779e65a8b09b4c0ff35f21.exe	28
PID 2844 wrote to memory of 2648	2844	c8518eded0779e65a8b09b4c0ff35f21.exe	28
PID 2844 wrote to memory of 2648	2844	c8518eded0779e65a8b09b4c0ff35f21.exe	28
PID 2844 wrote to memory of 2648	2844	c8518eded0779e65a8b09b4c0ff35f21.exe	28
PID 2844 wrote to memory of 2648	2844	c8518eded0779e65a8b09b4c0ff35f21.exe	28
PID 2648 wrote to memory of 1228	2648	c8518eded0779e65a8b09b4c0ff35f21.exe	21
PID 2648 wrote to memory of 1228	2648	c8518eded0779e65a8b09b4c0ff35f21.exe	21
PID 2648 wrote to memory of 1228	2648	c8518eded0779e65a8b09b4c0ff35f21.exe	21
PID 2648 wrote to memory of 1228	2648	c8518eded0779e65a8b09b4c0ff35f21.exe	21

memory/1228-9-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1228-12-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2648-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-8-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2648-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-22-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2844-0-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2844-2-0x0000000001DC0000-0x0000000001E00000-memory.dmp

Filesize
256KB

Download
memory/2844-1-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2844-6-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download