cf8f553cdf1b7748597a118416e41b1d6135633ebc6d0a09cefff76425855c7a

Analysis

max time kernel
136s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 17:14

Target

c92ae5be4af6e68ebf689a1d7c597703.exe
Size

386KB
MD5

c92ae5be4af6e68ebf689a1d7c597703
SHA1

77dfbe5954d0c6c953e3839aa88e42d3d37aec99
SHA256

cf8f553cdf1b7748597a118416e41b1d6135633ebc6d0a09cefff76425855c7a
SHA512

cfd6fa9e1500191b8b896e885d69e7a502ae70539ea3c066114ebca69d704e17be2b592ae8a57f0173e9d82c37fe73bf942aa975f19cf810f68a48a668e70cff
SSDEEP

6144:naordEkMQn1aOrX4KXZFuD2QjGcjqQeHTTs1yFb7PM5WkKkX7VNuN:aorukMk19rXCXvgTIWXP+1G

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3768	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 3768	2732	c92ae5be4af6e68ebf689a1d7c597703.exe	93

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	c92ae5be4af6e68ebf689a1d7c597703.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 3768	2732	c92ae5be4af6e68ebf689a1d7c597703.exe	93
PID 2732 wrote to memory of 3768	2732	c92ae5be4af6e68ebf689a1d7c597703.exe	93
PID 2732 wrote to memory of 3768	2732	c92ae5be4af6e68ebf689a1d7c597703.exe	93
PID 2732 wrote to memory of 3768	2732	c92ae5be4af6e68ebf689a1d7c597703.exe	93

C:\Users\Admin\AppData\Local\Temp\c92ae5be4af6e68ebf689a1d7c597703.exe
"C:\Users\Admin\AppData\Local\Temp\c92ae5be4af6e68ebf689a1d7c597703.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:3768

memory/2732-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2732-1-0x0000000002360000-0x000000000276F000-memory.dmp

Filesize
4.1MB

Download
memory/2732-2-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download