e84a261dd1a451e6b3ace88c08f83f17e8babf9be4d5dd9f0505be6f7a2f99bc

Analysis

max time kernel
192s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:44

Target

e84a261dd1a451e6b3ace88c08f83f17e8babf9be4d5dd9f0505be6f7a2f99bc.exe
Size

179KB
MD5

4e373c204bc8fc9cb8c9c731c59e77e2
SHA1

07c745fbcb1e34a836b4ef1e9b919deb84bb9b8d
SHA256

e84a261dd1a451e6b3ace88c08f83f17e8babf9be4d5dd9f0505be6f7a2f99bc
SHA512

ed180539a21e7e6dfe537aa7e85addabb0c5620ea004746103fb601b125621898bb4809f6cf05104f1b2f180cef919dd5c2a3c02a33028cdd0e9016542e48137
SSDEEP

3072:SdFpN5N5wzDUPy52qGN88zA2uR5Eqnhli9AgzykWWBtT470O0TOY/kEOYOXEq:Ip3VP8GN88zAdR5EqnhYWKykPE/

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
776	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	776	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 2324	764	e84a261dd1a451e6b3ace88c08f83f17e8babf9be4d5dd9f0505be6f7a2f99bc.exe	84
PID 764 wrote to memory of 2324	764	e84a261dd1a451e6b3ace88c08f83f17e8babf9be4d5dd9f0505be6f7a2f99bc.exe	84
PID 764 wrote to memory of 2324	764	e84a261dd1a451e6b3ace88c08f83f17e8babf9be4d5dd9f0505be6f7a2f99bc.exe	84
PID 2324 wrote to memory of 776	2324	cmd.exe	85
PID 2324 wrote to memory of 776	2324	cmd.exe	85
PID 2324 wrote to memory of 776	2324	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\e84a261dd1a451e6b3ace88c08f83f17e8babf9be4d5dd9f0505be6f7a2f99bc.exe
"C:\Users\Admin\AppData\Local\Temp\e84a261dd1a451e6b3ace88c08f83f17e8babf9be4d5dd9f0505be6f7a2f99bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im USBGuard.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im USBGuard.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:776