c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 22:14

Target

c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe
Size

85KB
MD5

09da0fc52c8932f73b3e0a7d5eee2a74
SHA1

b6da891a4f041d9368e649a91e3a89530b641a7f
SHA256

c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6
SHA512

46ee26dcec009d28f0bdb8460ad4155efcf71bae6275183512c993776d6a599da39c418080057a2426c1bcd8b9a2d7fbd47e68e5b099bffbdfcffbed07b6a088
SSDEEP

768:DMDDbe9Eku6jIj+m15qfVjZzn9Peuek0kekpkQi3Q:oDDKEkrbm1wfVVzz3N3mrQ

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1948	c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe
Token: SeDebugPrivilege	4516	c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4516	1948	c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe	82
PID 1948 wrote to memory of 4516	1948	c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe	82
PID 1948 wrote to memory of 4516	1948	c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe	82
PID 4516 wrote to memory of 2412	4516	c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe	83
PID 4516 wrote to memory of 2412	4516	c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe	83
PID 4516 wrote to memory of 2412	4516	c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe	83
PID 4516 wrote to memory of 2412	4516	c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe	83
PID 4516 wrote to memory of 2412	4516	c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe	83
PID 4516 wrote to memory of 2412	4516	c839ed02a4a953a0f11a17eae3d967bf8bbb5774e896683d54480934201579c6.exe	83

memory/1948-132-0x00000000005A0000-0x00000000005A7000-memory.dmp

Filesize
28KB

Download
memory/1948-133-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1948-137-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2412-138-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/4516-135-0x00000000004D0000-0x00000000004D7000-memory.dmp

Filesize
28KB

Download
memory/4516-136-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4516-140-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download