5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b

Analysis

max time kernel
8s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 16:47

Target

5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b.exe
Size

308KB
MD5

6c7e279b9298ea6c12e63c760b0a7a9b
SHA1

79976898c1b1298a58c787031bf23c626f09c122
SHA256

5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b
SHA512

18cb5c09151ace23bdad0c96569409501357083d1f2c63d2bfad1cb8930313c6b4b67298afcabb754506b36fd6c2c187e2abf6d3c5ae1d3499818967d89173d1
SSDEEP

6144:JRqmBKByO3a84W12T8WCW/rTd5APfd3WJpJBhniN0s0sFPYZgjVZC:JROOMQvCW/I9GROTv

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelp.exe	5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelp.exe	5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
912	5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
912	5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b.exe
Token: SeDebugPrivilege	912	5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 848	912	5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b.exe	27
PID 912 wrote to memory of 848	912	5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b.exe	27
PID 912 wrote to memory of 848	912	5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b.exe	27
PID 912 wrote to memory of 848	912	5504ed892e136abeadcb6eb132a542b4d3e5e84b59c7acb5fadd22fc5d137f6b.exe	27

memory/912-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/912-55-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download