794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5

Analysis

max time kernel
238s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 22:35

Target

794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe
Size

60KB
MD5

8e8342cfb3fbcce941b7b8c5d3f8a5c2
SHA1

5c9e80b0c3dc499fa0bf654683a1a928ba9e51f4
SHA256

794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5
SHA512

42f660e9ad3e2e9b9bf1d447049f992717b1b56bfaaa11cea2f001eba085850fd8c574d4a1433979bbdb683ba35242e9759b2ee35243524f0d25c0919980c3ce
SSDEEP

768:KPS9G1KJNiy+kl8H3ZwlY/9k6WsXDRK0lLs8ECmHnSEECmHnSOECmHnScECmHnSG:V9uWisl8H3mlY1kJ2ZLsdiQCq2b

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1120	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe
Token: SeDebugPrivilege	592	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1120	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe
592	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 592	1120	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	28
PID 1120 wrote to memory of 592	1120	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	28
PID 1120 wrote to memory of 592	1120	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	28
PID 1120 wrote to memory of 592	1120	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	28
PID 592 wrote to memory of 1448	592	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	29
PID 592 wrote to memory of 1448	592	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	29
PID 592 wrote to memory of 1448	592	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	29
PID 592 wrote to memory of 1448	592	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	29
PID 592 wrote to memory of 1448	592	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	29
PID 592 wrote to memory of 1448	592	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	29
PID 592 wrote to memory of 1448	592	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	29
PID 592 wrote to memory of 1448	592	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	29
PID 592 wrote to memory of 1448	592	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	29
PID 592 wrote to memory of 1448	592	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	29

memory/592-59-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/592-61-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1120-54-0x0000000074FA1000-0x0000000074FA3000-memory.dmp

Filesize
8KB

Download
memory/1120-58-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1120-57-0x00000000003C0000-0x00000000003C7000-memory.dmp

Filesize
28KB

Download
memory/1120-60-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download