794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5

Analysis

max time kernel
112s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 22:35

Target

794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe
Size

60KB
MD5

8e8342cfb3fbcce941b7b8c5d3f8a5c2
SHA1

5c9e80b0c3dc499fa0bf654683a1a928ba9e51f4
SHA256

794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5
SHA512

42f660e9ad3e2e9b9bf1d447049f992717b1b56bfaaa11cea2f001eba085850fd8c574d4a1433979bbdb683ba35242e9759b2ee35243524f0d25c0919980c3ce
SSDEEP

768:KPS9G1KJNiy+kl8H3ZwlY/9k6WsXDRK0lLs8ECmHnSEECmHnSOECmHnScECmHnSG:V9uWisl8H3mlY1kJ2ZLsdiQCq2b

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4216	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe
Token: SeDebugPrivilege	1576	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1576	4216	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	79
PID 4216 wrote to memory of 1576	4216	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	79
PID 4216 wrote to memory of 1576	4216	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	79
PID 1576 wrote to memory of 4264	1576	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	80
PID 1576 wrote to memory of 4264	1576	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	80
PID 1576 wrote to memory of 4264	1576	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	80
PID 1576 wrote to memory of 4264	1576	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	80
PID 1576 wrote to memory of 4264	1576	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	80
PID 1576 wrote to memory of 4264	1576	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	80
PID 1576 wrote to memory of 4264	1576	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	80
PID 1576 wrote to memory of 4264	1576	794bdad4c355f8cd31289284ed3276aaf70cbeb3a779ae81add44465b140fbd5.exe	80

memory/1576-138-0x0000000000680000-0x0000000000687000-memory.dmp

Filesize
28KB

Download
memory/1576-139-0x00000000006A0000-0x00000000006A7000-memory.dmp

Filesize
28KB

Download
memory/4216-132-0x0000000002020000-0x0000000002027000-memory.dmp

Filesize
28KB

Download
memory/4216-133-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4216-140-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4264-135-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download