23e37f56cd461cdb829cb481ca651b8ff3edf254ce221e49f5154ecb21420824

Analysis

max time kernel
39s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:00

Target

4568c8c79b9a6fa899b07886d540c9a3e2afb124ab4ca1520eb8baea1a2dffc9.exe
Size

83.6MB
MD5

0786d76cbbf390b342c5b65f14a23530
SHA1

2a758729935989e6f7c6cdd1ef3dbca7b2186e4d
SHA256

4568c8c79b9a6fa899b07886d540c9a3e2afb124ab4ca1520eb8baea1a2dffc9
SHA512

97433cd1c2606478b8cc13a2393dac3078d2224c79a79839ff96f8d0fba509b967ae2b0ee00c3a47e19a451288868f6783dcfbe7b74865a88bc05b3d253eaab6
SSDEEP

393216:Tmej3wbi7lr7zAyuo8YSTS1JnB3Zdp1uPGiSPWw1JR8Z7cohuuasgsERf:Tz3wu7l9uo8BTUVfp1uVS+w1rcha7f

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3536 set thread context of 3548	3536	4568c8c79b9a6fa899b07886d540c9a3e2afb124ab4ca1520eb8baea1a2dffc9.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	4568c8c79b9a6fa899b07886d540c9a3e2afb124ab4ca1520eb8baea1a2dffc9.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3548	3536	4568c8c79b9a6fa899b07886d540c9a3e2afb124ab4ca1520eb8baea1a2dffc9.exe	83
PID 3536 wrote to memory of 3548	3536	4568c8c79b9a6fa899b07886d540c9a3e2afb124ab4ca1520eb8baea1a2dffc9.exe	83
PID 3536 wrote to memory of 3548	3536	4568c8c79b9a6fa899b07886d540c9a3e2afb124ab4ca1520eb8baea1a2dffc9.exe	83
PID 3536 wrote to memory of 3548	3536	4568c8c79b9a6fa899b07886d540c9a3e2afb124ab4ca1520eb8baea1a2dffc9.exe	83
PID 3536 wrote to memory of 3548	3536	4568c8c79b9a6fa899b07886d540c9a3e2afb124ab4ca1520eb8baea1a2dffc9.exe	83

C:\Users\Admin\AppData\Local\Temp\4568c8c79b9a6fa899b07886d540c9a3e2afb124ab4ca1520eb8baea1a2dffc9.exe
"C:\Users\Admin\AppData\Local\Temp\4568c8c79b9a6fa899b07886d540c9a3e2afb124ab4ca1520eb8baea1a2dffc9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:3548

memory/3536-4-0x00007FF6DB090000-0x00007FF6E0517000-memory.dmp

Filesize
84.5MB

Download
memory/3536-9-0x00007FF6DB090000-0x00007FF6E0517000-memory.dmp

Filesize
84.5MB

Download
memory/3548-5-0x00000000007E0000-0x0000000000835000-memory.dmp

Filesize
340KB

Download
memory/3548-7-0x00000000007E0000-0x0000000000835000-memory.dmp

Filesize
340KB

Download
memory/3548-8-0x00000000007E0000-0x0000000000835000-memory.dmp

Filesize
340KB

Download
memory/3548-10-0x00000000007E0000-0x0000000000835000-memory.dmp

Filesize
340KB

Download