197a25c99204fe5f2a02cdffc1a4d4e7f5b7ca003bcfd90fc54c8057521e38f3

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 01:05

Target

QUOTE - FE7191PO154.exe
Size

824KB
MD5

5898fd19077369ca6c8f80ddc009a433
SHA1

970a6ffcc89ddfddccff95010c499f5e83473800
SHA256

bb6c1c855a768f76b9d130976331ab87f18a2f38190de1fae466da8c8b292fbb
SHA512

fbc1996d0e87a2a64dff96fd5a60551222766497de8e2c2c6d7f05716cb44d300c9173dfe81563db0d1f9e49d9b5d100f52cc6668491e24d12e46f614fb23ac0
SSDEEP

24576:GKk5kYOPu2hnx2kgLpZdj9RMhmrax7lvi:GKC66vLpamux5v

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 2204	2020	QUOTE - FE7191PO154.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2020	QUOTE - FE7191PO154.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	QUOTE - FE7191PO154.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2204	2020	QUOTE - FE7191PO154.exe	28
PID 2020 wrote to memory of 2204	2020	QUOTE - FE7191PO154.exe	28
PID 2020 wrote to memory of 2204	2020	QUOTE - FE7191PO154.exe	28
PID 2020 wrote to memory of 2204	2020	QUOTE - FE7191PO154.exe	28

C:\Users\Admin\AppData\Local\Temp\QUOTE - FE7191PO154.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTE - FE7191PO154.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\QUOTE - FE7191PO154.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTE - FE7191PO154.exe"
  2⤵
  PID:2204

memory/2020-0-0x000007FEF53E3000-0x000007FEF53E4000-memory.dmp

Filesize
4KB

Download
memory/2020-1-0x000000013F800000-0x000000013F8D2000-memory.dmp

Filesize
840KB

Download
memory/2020-2-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2020-3-0x00000000005C0000-0x00000000005E4000-memory.dmp

Filesize
144KB

Download
memory/2020-4-0x00000000007E0000-0x00000000007F6000-memory.dmp

Filesize
88KB

Download
memory/2020-5-0x0000000000800000-0x0000000000814000-memory.dmp

Filesize
80KB

Download
memory/2020-6-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2020-7-0x000000001C4F0000-0x000000001C578000-memory.dmp

Filesize
544KB

Download
memory/2020-10-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2204-8-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmp

Filesize
4KB

Download