b8beb5e27fc339772b63ed454ec054a16b554e5c354eab8de7b4addbe238f403

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 01:42

Target

op/Hazel.exe
Size

8KB
MD5

1ad818406f06d1cb728b5d0f324fb3b5
SHA1

2cedfaef2739f3960194b19e3ee61eeec4820f3e
SHA256

85a6ac13510983b3a29ccb2527679d91c86c1f91fdfee68913bc5d3d01eeda2b
SHA512

4703dc1549cedf09eab7c7862ec340ad0b5750149374a0cb281f5b985e594851a11757966a0f90307937e7a9b19dbdd8e50051142081b81536ea64b5d05c0085
SSDEEP

96:Mj3Er0k4gZJUoWYs9a5O8ng8nK8n6Y+9heuYkUBmaTbkBXBgf6nt3xy72NqNE5TS:MjUr0xgDeodn9n/nD+KL+aTbu1toC3g

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
800	Hazel.exe
800	Hazel.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	800	Hazel.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2068	800	Hazel.exe	28
PID 800 wrote to memory of 2068	800	Hazel.exe	28
PID 800 wrote to memory of 2068	800	Hazel.exe	28
PID 2068 wrote to memory of 2076	2068	cmd.exe	30
PID 2068 wrote to memory of 2076	2068	cmd.exe	30
PID 2068 wrote to memory of 2076	2068	cmd.exe	30
PID 800 wrote to memory of 2188	800	Hazel.exe	31
PID 800 wrote to memory of 2188	800	Hazel.exe	31
PID 800 wrote to memory of 2188	800	Hazel.exe	31

memory/800-0-0x000007FEF58A3000-0x000007FEF58A4000-memory.dmp

Filesize
4KB

Download
memory/800-1-0x0000000000250000-0x0000000000258000-memory.dmp

Filesize
32KB

Download
memory/800-2-0x000007FEF58A3000-0x000007FEF58A4000-memory.dmp

Filesize
4KB

Download
memory/800-3-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

Filesize
9.9MB

Download
memory/800-4-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

Filesize
9.9MB

Download