5ff14d16853c8c9b95a9d7a337f2196cbeca4d3169725b0f906c91efd272934b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 20:42

Target

AdobeGenP-3.4.13.4.exe
Size

1.1MB
MD5

dda7ac07c4630a25a65a40eb4065b0c8
SHA1

37ebcf8f91c0b739a62823be6e89443e1d36a026
SHA256

3c80ba8fcdf07dcf7f676fa69f043bbc0c127680514281aced70c2ba9775c1fb
SHA512

736a3bb7b330daac0a413f747e83bcb65ff97d8653ff2e64bd5e089321823fe2630c4a211cf84f97784babde93096615c935a45930edd5870e03b0a9a522f951
SSDEEP

24576:irORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvaXx8mfmW:i2EYTb8atv1orq+pEiSDTj1VyvBaXxpu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3704	NSudoLG.exe
3704	NSudoLG.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3704	NSudoLG.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 3704	2308	AdobeGenP-3.4.13.4.exe	83
PID 2308 wrote to memory of 3704	2308	AdobeGenP-3.4.13.4.exe	83

C:\Users\Admin\AppData\Local\Temp\AdobeGenP-3.4.13.4.exe
"C:\Users\Admin\AppData\Local\Temp\AdobeGenP-3.4.13.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\NSudoLG.exe
  C:\Users\Admin\AppData\Local\Temp\NSudoLG.exe -U:T -P:E -M:S "C:\Users\Admin\AppData\Local\Temp\AdobeGenP-3.4.13.4.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3704