5d79a45ff16d4f1dd622512bbd3b15bdb2586f1d496e108c3b75d84329195f9b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 08:30

Target

GenP-3.4.14.0.exe
Size

1.1MB
MD5

b96713a17862524497df280b06f62114
SHA1

dd29da880b0f1fa5ea48171522e1c8729270ae8e
SHA256

e1655efbf8b3b0a2e7fc982816f67aabfe554a8b6ad0a158e085aeac3121a51a
SHA512

91e82c338d954f845b576c51be9fcbf59d07fe8b894c16fd00fdf38642dae2b87ce1d9e422d43a1ba22341c10aa90f7f746a85d42fee8b2d7473440c1e2956df
SSDEEP

24576:KrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvayx8mfm1A:K2EYTb8atv1orq+pEiSDTj1VyvBayxpu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2404	NSudoLG.exe
2404	NSudoLG.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	NSudoLG.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2404	2284	GenP-3.4.14.0.exe	30
PID 2284 wrote to memory of 2404	2284	GenP-3.4.14.0.exe	30
PID 2284 wrote to memory of 2404	2284	GenP-3.4.14.0.exe	30

C:\Users\Admin\AppData\Local\Temp\GenP-3.4.14.0.exe
"C:\Users\Admin\AppData\Local\Temp\GenP-3.4.14.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\NSudoLG.exe
  C:\Users\Admin\AppData\Local\Temp\NSudoLG.exe -U:T -P:E -M:S "C:\Users\Admin\AppData\Local\Temp\GenP-3.4.14.0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2404