e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 06:26

Target

e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe
Size

87KB
MD5

4dbc0d076b1b760af444cfc850596a7f
SHA1

0f55394c5834e2f8556f0e41f076c0984970a12a
SHA256

e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd
SHA512

83f95b61d5434585c128a58ec3d2f67eae04d938bbbe7e0eb60c09ab2ca41c635be649bffc67cb2e20b0751590ed44e9ec30259a1cce42e48874f33828f87f16
SSDEEP

1536:2WWisl8H3mXwlf6tOzLR9zJK6uK6+K6NK6JzO:aF8HWgE0zLR9ztcsRJC

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1188	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1188	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe
Token: SeDebugPrivilege	540	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 540	1188	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe	83
PID 1188 wrote to memory of 540	1188	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe	83
PID 1188 wrote to memory of 540	1188	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe	83
PID 540 wrote to memory of 1748	540	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe	84
PID 540 wrote to memory of 1748	540	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe	84
PID 540 wrote to memory of 1748	540	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe	84
PID 540 wrote to memory of 1748	540	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe	84
PID 540 wrote to memory of 1748	540	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe	84
PID 540 wrote to memory of 1748	540	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe	84
PID 540 wrote to memory of 1748	540	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe	84
PID 540 wrote to memory of 1748	540	e9084c1232554f3d6e52ccfe858e76527dfe64e52cb1c483982286cac830b1dd.exe	84

memory/540-138-0x00000000004D0000-0x00000000004D7000-memory.dmp

Filesize
28KB

Download
memory/540-139-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/540-141-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1188-136-0x0000000002030000-0x0000000002037000-memory.dmp

Filesize
28KB

Download
memory/1188-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1188-140-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1748-133-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download