279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 10:59

Target

279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735.exe
Size

12KB
MD5

1c5c05eb9d52ddce3b08f99c45e541d1
SHA1

bb314dbe5568aa1227091ba709bf796dc3da16c8
SHA256

279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735
SHA512

e75079fd84ce6f68ee9853c5a532458c09167e0e09450f219efde445c0d2e1f63ad2d389262d6fecbece67b8f83e9f80d12f1c951d2e0876ba56a666aaeeb222
SSDEEP

192:EtvzctIHPWBCcms2kmYgBIlUktua1ptZxkMpPAp2aW5MOeGJ8wIBd:+QtIHOuxk46/tuaXTh3BeGJ8wM

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5028-135-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/5028-138-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 3532	5028	279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735.exe	81
PID 5028 wrote to memory of 3532	5028	279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735.exe	81
PID 5028 wrote to memory of 3532	5028	279635d1e38d7de4ddd9d017243c10c5da4ba95be4afb96a8a8b6b1e44f5d735.exe	81
PID 3532 wrote to memory of 3348	3532	net.exe	83
PID 3532 wrote to memory of 3348	3532	net.exe	83
PID 3532 wrote to memory of 3348	3532	net.exe	83

memory/5028-135-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5028-138-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download