79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170

Analysis

max time kernel
30s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:45

Target

79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170.exe
Size

180KB
MD5

1487ebe0a2d5c231876f4daa54f01e4c
SHA1

e95fdbdc98cedcfd0ab855bcc7ef241130136d22
SHA256

79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170
SHA512

e14245df91f609d9b75cf2d2cd1006ffd2eb762683ec85f82bf97f0abdf8218c3c997744ba0cc9297cececaf63a1aea366cc64a90da45b9f7ff41885ca3d0923
SSDEEP

3072:cH+q+Q8wJno2lKiXNbb/gBXWXjZGMP+0eeydD8lg82XyAUvF:Zlw9ayCBXMjc0WDWtAUvF

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/916-55-0x0000000001000000-0x0000000001053000-memory.dmp	upx
behavioral1/memory/916-56-0x0000000001000000-0x0000000001053000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170.exe

description pid process

Token: SeTakeOwnershipPrivilege 916 79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	916	79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170.exe

C:\Users\Admin\AppData\Local\Temp\79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170.exe
"C:\Users\Admin\AppData\Local\Temp\79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:916

memory/916-55-0x0000000001000000-0x0000000001053000-memory.dmp

Filesize
332KB

Download
memory/916-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/916-56-0x0000000001000000-0x0000000001053000-memory.dmp

Filesize
332KB

Download