76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 10:26

Target

76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe
Size

787KB
MD5

a94234a6d9ad8404238718bd6b27f64c
SHA1

aed801d7eac6bef69a7c76e228ad3819e4b09edd
SHA256

76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286
SHA512

0d134c6648da84e7326498bf29d2b73867c40db37aab550350d7c3a9a40405cadf7de4f77dc46480805acca8b2e707360efbc916d278d7fa87727c749f8be8a6
SSDEEP

12288:4ABPJwKcIlr7O8BkFOHAnJfmrFchsUQuYs4r1+r/dHV+57RQzsp2JHUxOKOZ64u4:4ABhcar7O98AJurqgoMsTHJHUxj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1336 set thread context of 2936	1336	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2788	2936	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2936	1336	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	28
PID 1336 wrote to memory of 2936	1336	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	28
PID 1336 wrote to memory of 2936	1336	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	28
PID 1336 wrote to memory of 2936	1336	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	28
PID 1336 wrote to memory of 2936	1336	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	28
PID 1336 wrote to memory of 2936	1336	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	28
PID 1336 wrote to memory of 2936	1336	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	28
PID 2936 wrote to memory of 2788	2936	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	31
PID 2936 wrote to memory of 2788	2936	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	31
PID 2936 wrote to memory of 2788	2936	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	31
PID 2936 wrote to memory of 2788	2936	76565a0918c66c2e70d053d7216a79ea4a4447e9278f1063cd4d14c41bcda286.exe	31

memory/1336-12-0x0000000074A00000-0x00000000750EE000-memory.dmp

Filesize
6.9MB

Download
memory/1336-1-0x0000000001390000-0x000000000145C000-memory.dmp

Filesize
816KB

Download
memory/1336-2-0x0000000074A00000-0x00000000750EE000-memory.dmp

Filesize
6.9MB

Download
memory/1336-3-0x00000000001E0000-0x00000000001F8000-memory.dmp

Filesize
96KB

Download
memory/1336-4-0x0000000000210000-0x0000000000220000-memory.dmp

Filesize
64KB

Download
memory/1336-5-0x00000000082E0000-0x000000000836A000-memory.dmp

Filesize
552KB

Download
memory/1336-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

Filesize
4KB

Download
memory/2936-6-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2936-11-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2936-10-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2936-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2936-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2936-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2936-14-0x0000000000900000-0x0000000000C03000-memory.dmp

Filesize
3.0MB

Download