a2bad6f3295d4cfc8b63bb059ca536f16c3193dce299e631563b7b04e39530a7

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 08:09

Target

Consignment Notification- 7056432910.exe
Size

743KB
MD5

03ef802be1a0f396e1035594b6af958d
SHA1

b3aebdfbbcbc548d387c2c8ef8ab06213f42bfb4
SHA256

52f2b64436988a3a692aad80b6a2f619463766e158f5e9c494d87e10e8def6dd
SHA512

bdb9ce902de706de9d1d6ef97ea6a73aec79e70b1399a7a83bd43844752dbcd0160c551ff5f52d6337dad8d3eb3384bfc57365cf8162ea015d7c2109bb7aa13e
SSDEEP

12288:J9/NkFzQmt3CeQgDwN8bzmWvdP62KEIEM/ZbOwgafVPRO+5DiQXq6:7/NkFQmtRvG8bzzlP6wvvCPQ0rR

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1560 set thread context of 2632	1560	Consignment Notification- 7056432910.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1560	Consignment Notification- 7056432910.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	Consignment Notification- 7056432910.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2632	1560	Consignment Notification- 7056432910.exe	28
PID 1560 wrote to memory of 2632	1560	Consignment Notification- 7056432910.exe	28
PID 1560 wrote to memory of 2632	1560	Consignment Notification- 7056432910.exe	28
PID 1560 wrote to memory of 2632	1560	Consignment Notification- 7056432910.exe	28

C:\Users\Admin\AppData\Local\Temp\Consignment Notification- 7056432910.exe
"C:\Users\Admin\AppData\Local\Temp\Consignment Notification- 7056432910.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  2⤵
  PID:2632

memory/1560-0-0x000007FEF6163000-0x000007FEF6164000-memory.dmp

Filesize
4KB

Download
memory/1560-1-0x0000000000F90000-0x0000000001050000-memory.dmp

Filesize
768KB

Download
memory/1560-2-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmp

Filesize
9.9MB

Download
memory/1560-3-0x0000000000CE0000-0x0000000000D04000-memory.dmp

Filesize
144KB

Download
memory/1560-4-0x0000000000D80000-0x0000000000D96000-memory.dmp

Filesize
88KB

Download
memory/1560-5-0x0000000000760000-0x0000000000774000-memory.dmp

Filesize
80KB

Download
memory/1560-6-0x000000001C130000-0x000000001C1B8000-memory.dmp

Filesize
544KB

Download
memory/1560-9-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmp

Filesize
9.9MB

Download
memory/2632-7-0x000007FFFFFD4000-0x000007FFFFFD5000-memory.dmp

Filesize
4KB

Download