f639e8a0167dc0449b1477477740ad966fa7276b0039dc671ab3a36fdae2d837

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 02:37

Target

f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe
Size

818KB
MD5

272f79d7dba64ba20220bb1defc4839e
SHA1

400167cf29c6724242d427c7d4bf5269098521c5
SHA256

f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b
SHA512

abd7f51cc69148b0dc4732e4649447c1a654252b9a1cd49ec78a26d1dc26e176101b9a888515335488fcd595b9da5c288a6be999c133550b894cb299a18a991f
SSDEEP

24576:Sv7C3c6roXM/Qm39KcZvCooxgxUpClDffxh5gtY+VTkC:SzooX8JhZvIxgxKClDxh5gtY+VTk

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2824 set thread context of 2844	2824	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2844	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2844	2824	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe	28
PID 2824 wrote to memory of 2844	2824	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe	28
PID 2824 wrote to memory of 2844	2824	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe	28
PID 2824 wrote to memory of 2844	2824	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe	28
PID 2824 wrote to memory of 2844	2824	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe	28
PID 2824 wrote to memory of 2844	2824	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe	28
PID 2824 wrote to memory of 2844	2824	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe	28
PID 2844 wrote to memory of 2644	2844	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe	29
PID 2844 wrote to memory of 2644	2844	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe	29
PID 2844 wrote to memory of 2644	2844	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe	29
PID 2844 wrote to memory of 2644	2844	f213641d9a278bd07f490d237d7b51f77f106fd345a8627a955904f3757b9d8b.exe	29

memory/2824-6-0x0000000004E70000-0x0000000004EFA000-memory.dmp

Filesize
552KB

Download
memory/2824-3-0x0000000000470000-0x0000000000486000-memory.dmp

Filesize
88KB

Download
memory/2824-1-0x00000000001B0000-0x0000000000282000-memory.dmp

Filesize
840KB

Download
memory/2824-0-0x00000000742CE000-0x00000000742CF000-memory.dmp

Filesize
4KB

Download
memory/2824-4-0x00000000004A0000-0x00000000004AE000-memory.dmp

Filesize
56KB

Download
memory/2824-5-0x00000000004F0000-0x0000000000500000-memory.dmp

Filesize
64KB

Download
memory/2824-2-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/2824-13-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/2844-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2844-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2844-11-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2844-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2844-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2844-14-0x0000000000A80000-0x0000000000D83000-memory.dmp

Filesize
3.0MB

Download
memory/2844-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download