c3b51e92d7b03741836798a03a2e3cbddc9a6c78ff99cd7d916d629efbeb6c8c

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 07:32

Target

RFQ QUG24-20037005420.exe
Size

1.1MB
MD5

855d14c3666d2c2696b2c1cf39d788fd
SHA1

1abbab058c89f823d8ef2616ce6f9260f48d43fd
SHA256

4bc13d2eb3e05dfa83c292d05bbcfeb0201f385c59e22a2eede6beb1df384586
SHA512

6d8962244e07ea3e3eaa7e777d0c1e45dffa44dddc8ea2edb0f0cfd9d423df3fb39a887ea907e9658eadaeae97424b7f2746066dee4b32b5b14ed45396a7590f
SSDEEP

12288:ExrYcvryCx+pEk28M0g8OhBdAJVzgxUSxi1KsHAZaW7Ww9j+6sF0ZWPKmIFhlyZq:Ox+h+uwsF0Z7F3SZpbOoWqc5C19

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 2004	1760	RFQ QUG24-20037005420.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	RFQ QUG24-20037005420.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	RFQ QUG24-20037005420.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2004	1760	RFQ QUG24-20037005420.exe	28
PID 1760 wrote to memory of 2004	1760	RFQ QUG24-20037005420.exe	28
PID 1760 wrote to memory of 2004	1760	RFQ QUG24-20037005420.exe	28
PID 1760 wrote to memory of 2004	1760	RFQ QUG24-20037005420.exe	28

C:\Users\Admin\AppData\Local\Temp\RFQ QUG24-20037005420.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ QUG24-20037005420.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\RFQ QUG24-20037005420.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ QUG24-20037005420.exe"
  2⤵
  PID:2004

memory/1760-0-0x000007FEF5C23000-0x000007FEF5C24000-memory.dmp

Filesize
4KB

Download
memory/1760-1-0x000000013F9E0000-0x000000013FB04000-memory.dmp

Filesize
1.1MB

Download
memory/1760-2-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download
memory/1760-3-0x0000000000850000-0x0000000000874000-memory.dmp

Filesize
144KB

Download
memory/1760-4-0x0000000000A00000-0x0000000000A16000-memory.dmp

Filesize
88KB

Download
memory/1760-5-0x0000000000660000-0x0000000000674000-memory.dmp

Filesize
80KB

Download
memory/1760-6-0x000000001C540000-0x000000001C5C8000-memory.dmp

Filesize
544KB

Download
memory/1760-9-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download
memory/2004-7-0x000007FFFFFD3000-0x000007FFFFFD4000-memory.dmp

Filesize
4KB

Download