0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20

Resubmissions

22-05-2024 22:56

22-05-2024 22:55

max time kernel
92s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 22:56

Target

0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe
Size

678KB
MD5

541433c2ea0a8df3a5536aeeff29e455
SHA1

1958ca89467db2ec9f38dd6f5e85b17888146fbc
SHA256

0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20
SHA512

27e5893dda272fffcbb0e6e201be78bc4fe38a79f92be7e674fdc1105586f60ecc1fba62933751c15f62168d39ff3cb52f6752d11c4a8c30efdf2be907686f84
SSDEEP

12288:ONaeAQYBdVWf3aUAoHCyfT9OLYh3NdYe1Je5SVEEv4:pYYBbWf3ZAoTfTwY9dV0AEM4

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe

description	pid	process	target process
PID 2612 set thread context of 1036	2612	0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe	0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe

pid process

2612 0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe

description pid process

Token: SeDebugPrivilege 2612 0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe

pid	process
2612	0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe

description	pid	process
Token: SeDebugPrivilege	2612	0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe

description	pid	process	target process
PID 2612 wrote to memory of 1036	2612	0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe	0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe
PID 2612 wrote to memory of 1036	2612	0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe	0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe
PID 2612 wrote to memory of 1036	2612	0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe	0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe

C:\Users\Admin\AppData\Local\Temp\0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe
C:\Users\Admin\AppData\Local\Temp\0188afd1981d1f23cb7dc4b9acc86642650a6c43948a9241940218eea9c6bd20.exe
2⤵
PID:1036

memory/2612-0-0x00007FFBA8EB3000-0x00007FFBA8EB5000-memory.dmp

Filesize
8KB

Download
memory/2612-1-0x00000000002D0000-0x000000000037E000-memory.dmp

Filesize
696KB

Download
memory/2612-2-0x00007FFBA8EB0000-0x00007FFBA9972000-memory.dmp

Filesize
10.8MB

Download
memory/2612-3-0x0000000002E00000-0x0000000002E1C000-memory.dmp

Filesize
112KB

Download
memory/2612-4-0x0000000002E30000-0x0000000002E44000-memory.dmp

Filesize
80KB

Download
memory/2612-5-0x000000001CE90000-0x000000001CF10000-memory.dmp

Filesize
512KB

Download
memory/2612-7-0x00007FFBA8EB0000-0x00007FFBA9972000-memory.dmp

Filesize
10.8MB

Download