3077029e7ad5032ac31a547d76a7a4b8de9072616eed14123b7b2cb7d80d24d4

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 16:55

Target

PI-PRSS13T.exe
Size

1016KB
MD5

f9200ab1cfa5e0eedd43218cee4950d5
SHA1

d2e8b6fbf64c044103066ddb91e1f97f87e3e479
SHA256

3077029e7ad5032ac31a547d76a7a4b8de9072616eed14123b7b2cb7d80d24d4
SHA512

6b20fe02ecd9627a02435b38ea58773f82376701475a1f7c8b5827b93c49a66158c8f25e67b302a5f90a9d98d3ccd133d87bac52400aff295543792fee6371be
SSDEEP

12288:c3JSO8dcUTNmfkI2GKPX4BqWLUSE2h7pChWcB/RUYO5MRLFZNCix1MJS0+5:c3J/fkNGg4BrUa+/RUV8zNCiTt0K

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	PI-PRSS13T.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 472	2044	PI-PRSS13T.exe	27
PID 2044 wrote to memory of 472	2044	PI-PRSS13T.exe	27
PID 2044 wrote to memory of 472	2044	PI-PRSS13T.exe	27
PID 2044 wrote to memory of 472	2044	PI-PRSS13T.exe	27
PID 2044 wrote to memory of 1732	2044	PI-PRSS13T.exe	28
PID 2044 wrote to memory of 1732	2044	PI-PRSS13T.exe	28
PID 2044 wrote to memory of 1732	2044	PI-PRSS13T.exe	28
PID 2044 wrote to memory of 1732	2044	PI-PRSS13T.exe	28
PID 2044 wrote to memory of 1040	2044	PI-PRSS13T.exe	29
PID 2044 wrote to memory of 1040	2044	PI-PRSS13T.exe	29
PID 2044 wrote to memory of 1040	2044	PI-PRSS13T.exe	29
PID 2044 wrote to memory of 1040	2044	PI-PRSS13T.exe	29
PID 2044 wrote to memory of 1776	2044	PI-PRSS13T.exe	30
PID 2044 wrote to memory of 1776	2044	PI-PRSS13T.exe	30
PID 2044 wrote to memory of 1776	2044	PI-PRSS13T.exe	30
PID 2044 wrote to memory of 1776	2044	PI-PRSS13T.exe	30
PID 2044 wrote to memory of 1772	2044	PI-PRSS13T.exe	31
PID 2044 wrote to memory of 1772	2044	PI-PRSS13T.exe	31
PID 2044 wrote to memory of 1772	2044	PI-PRSS13T.exe	31
PID 2044 wrote to memory of 1772	2044	PI-PRSS13T.exe	31

C:\Users\Admin\AppData\Local\Temp\PI-PRSS13T.exe
"C:\Users\Admin\AppData\Local\Temp\PI-PRSS13T.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\PI-PRSS13T.exe
  "C:\Users\Admin\AppData\Local\Temp\PI-PRSS13T.exe"
  2⤵
  PID:472
- C:\Users\Admin\AppData\Local\Temp\PI-PRSS13T.exe
  "C:\Users\Admin\AppData\Local\Temp\PI-PRSS13T.exe"
  2⤵
  PID:1732
- C:\Users\Admin\AppData\Local\Temp\PI-PRSS13T.exe
  "C:\Users\Admin\AppData\Local\Temp\PI-PRSS13T.exe"
  2⤵
  PID:1040
- C:\Users\Admin\AppData\Local\Temp\PI-PRSS13T.exe
  "C:\Users\Admin\AppData\Local\Temp\PI-PRSS13T.exe"
  2⤵
  PID:1776
- C:\Users\Admin\AppData\Local\Temp\PI-PRSS13T.exe
  "C:\Users\Admin\AppData\Local\Temp\PI-PRSS13T.exe"
  2⤵
  PID:1772

memory/2044-54-0x00000000000D0000-0x00000000001D4000-memory.dmp

Filesize
1.0MB

Download
memory/2044-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x0000000000590000-0x00000000005AA000-memory.dmp

Filesize
104KB

Download
memory/2044-57-0x00000000005B0000-0x00000000005BC000-memory.dmp

Filesize
48KB

Download
memory/2044-58-0x0000000005E40000-0x0000000005EC0000-memory.dmp

Filesize
512KB

Download
memory/2044-59-0x0000000002040000-0x0000000002066000-memory.dmp

Filesize
152KB

Download