87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5

Analysis

max time kernel
90s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10-08-2024 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5.exe
Size

662KB
MD5

4ae02ce23e76c0d777a9000222e4336c
SHA1

4ad1cdcd30abc364dc93e671cec58461c1f7f2c2
SHA256

87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5
SHA512

c68eeac1bfe39ff7ce6d10c1e276ae98d5c7c56513bf0a172fb87da187671a3dbb02ff01fdeb588d819ae8ba2433e222a5e7dc1825675a0af78b7b4be1ef0c47
SSDEEP

12288:p5f3l8xufKg2UMSo/olMCsfMWsM8bs/AqFyJVH8sy9r/ud013YQqrYDiDM4kp:ptCFnVwlMaKAmyJ9etmyYQqrwiJk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 5000	2408	87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5.exe	83

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5.exe
Token: SeDebugPrivilege	5000	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 5000	2408	87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5.exe	83
PID 2408 wrote to memory of 5000	2408	87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5.exe	83
PID 2408 wrote to memory of 5000	2408	87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5.exe	83
PID 2408 wrote to memory of 5000	2408	87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5.exe	83
PID 2408 wrote to memory of 5000	2408	87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5.exe	83
PID 2408 wrote to memory of 5000	2408	87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5.exe	83

C:\Users\Admin\AppData\Local\Temp\87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5.exe
"C:\Users\Admin\AppData\Local\Temp\87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-31-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-3-0x00007FFAA0650000-0x00007FFAA1112000-memory.dmp

Filesize
10.8MB

Download
memory/2408-2-0x00000128EBB90000-0x00000128EBC9A000-memory.dmp

Filesize
1.0MB

Download
memory/2408-33-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-9-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-65-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-67-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-63-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-61-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-59-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-35-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-55-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-0-0x00000128E96E0000-0x00000128E978A000-memory.dmp

Filesize
680KB

Download
memory/2408-51-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-49-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-48-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-45-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-44-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-41-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-39-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-57-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-1-0x00007FFAA0653000-0x00007FFAA0655000-memory.dmp

Filesize
8KB

Download
memory/2408-53-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-29-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-27-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-37-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-4-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-25-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-23-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-21-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-19-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-17-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-15-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-8-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-6-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-13-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-11-0x00000128EBB90000-0x00000128EBC95000-memory.dmp

Filesize
1.0MB

Download
memory/2408-4008-0x00000128EBD10000-0x00000128EBD66000-memory.dmp

Filesize
344KB

Download
memory/2408-4009-0x00000128EBD70000-0x00000128EBDBC000-memory.dmp

Filesize
304KB

Download
memory/2408-4012-0x00007FFAA0650000-0x00007FFAA1112000-memory.dmp

Filesize
10.8MB

Download
memory/5000-4179-0x00007FFAA0650000-0x00007FFAA1112000-memory.dmp

Filesize
10.8MB

Download
memory/5000-4013-0x00007FFAA0650000-0x00007FFAA1112000-memory.dmp

Filesize
10.8MB

Download
memory/5000-8019-0x00007FFAA0650000-0x00007FFAA1112000-memory.dmp

Filesize
10.8MB

Download
memory/5000-8020-0x00007FFAA0650000-0x00007FFAA1112000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads