753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3

Analysis

max time kernel
134s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 22:33

Target

753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe
Size

55KB
MD5

924aa0f25a06b546ca3e3ab428b0db10
SHA1

3b51c7eb3a64fe8d795570843cda0229a66f4ef0
SHA256

753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3
SHA512

3c1dd35768a99490e393cbcffe5e67f65fe09066b2bf40281e9cde62ef8d0d58977ef66d22b124b9339d26f68d94e31e6ef0d29dd368c27372307db0315edc14
SSDEEP

768:dJ9rgBZyD4+abanIJqs7ZOyfDi9r13PMOZ/:djFk/banI0s7ZOqDQJ

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
748	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	748	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe
Token: SeDebugPrivilege	2280	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2280	748	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	83
PID 748 wrote to memory of 2280	748	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	83
PID 748 wrote to memory of 2280	748	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	83
PID 2280 wrote to memory of 2164	2280	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	84
PID 2280 wrote to memory of 2164	2280	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	84
PID 2280 wrote to memory of 2164	2280	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	84
PID 2280 wrote to memory of 2164	2280	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	84
PID 2280 wrote to memory of 2164	2280	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	84
PID 2280 wrote to memory of 2164	2280	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	84
PID 2280 wrote to memory of 2164	2280	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	84
PID 2280 wrote to memory of 2164	2280	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	84
PID 2280 wrote to memory of 2164	2280	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	84
PID 2280 wrote to memory of 2164	2280	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	84

memory/748-133-0x0000000000690000-0x0000000000698000-memory.dmp

Filesize
32KB

Download
memory/748-134-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/748-136-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2164-137-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Filesize
4KB

Download
memory/2280-135-0x0000000000580000-0x0000000000588000-memory.dmp

Filesize
32KB

Download
memory/2280-141-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download