852d6ec3baec3336fcf97f83b76634ca8f8b16915431ad3e40ef3f51a86b6873

Resubmissions

01-08-2024 21:40

01-08-2024 21:36

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:36

Target

AdobeGenP-3.4.13.4.exe
Size

1.1MB
MD5

dda7ac07c4630a25a65a40eb4065b0c8
SHA1

37ebcf8f91c0b739a62823be6e89443e1d36a026
SHA256

3c80ba8fcdf07dcf7f676fa69f043bbc0c127680514281aced70c2ba9775c1fb
SHA512

736a3bb7b330daac0a413f747e83bcb65ff97d8653ff2e64bd5e089321823fe2630c4a211cf84f97784babde93096615c935a45930edd5870e03b0a9a522f951
SSDEEP

24576:irORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvaXx8mfmW:i2EYTb8atv1orq+pEiSDTj1VyvBaXxpu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2124	NSudoLG.exe
2124	NSudoLG.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	NSudoLG.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2124	2536	AdobeGenP-3.4.13.4.exe	31
PID 2536 wrote to memory of 2124	2536	AdobeGenP-3.4.13.4.exe	31
PID 2536 wrote to memory of 2124	2536	AdobeGenP-3.4.13.4.exe	31

C:\Users\Admin\AppData\Local\Temp\AdobeGenP-3.4.13.4.exe
"C:\Users\Admin\AppData\Local\Temp\AdobeGenP-3.4.13.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\NSudoLG.exe
  C:\Users\Admin\AppData\Local\Temp\NSudoLG.exe -U:T -P:E -M:S "C:\Users\Admin\AppData\Local\Temp\AdobeGenP-3.4.13.4.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124