Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 23, 2025, 6:23 p.m.	Jan. 23, 2025, 6:25 p.m.

Size	1.0MB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`7d9213f8f3cba4035542eff1c9dbb341`
SHA256	`1f74ed6e61880d19e53cde5b0d67a0507bfda0be661860300dcb0f20ea9a45f4`
CRC32	`D8803F45`
ssdeep	`24576:BvNuXoELdBSWmPstYX3WqgkoZ7g/28DDghyhpRT4vyDLk9a0dYg:BvN2dBSWmPDX/gX7K2yDghMrT4KDLO`
PDB Path	D:\a\SharpHound\SharpHound\obj\Release\net462\SharpHound.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

SharpHound.exe "C:\Users\test22\AppData\Local\Temp\SharpHound.exe"
940

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 23, 2025, 6:23 p.m.			0	0
IsDebuggerPresent Jan. 23, 2025, 6:23 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 23, 2025, 6:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031b9d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031b9d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031b9d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031bab0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031bab0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 23, 2025, 6:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000031bc00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\a\SharpHound\SharpHound\obj\Release\net462\SharpHound.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 23, 2025, 6:23 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (42 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c6b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e2a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93edc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ee0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 23, 2025, 6:23 p.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e3d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000ff000', u'virtual_address': u'0x00002000', u'entropy': 7.940207003731999, u'name': u'.text', u'virtual_size': u'0x000fef94'}

entropy

7.94020700373

description

A section with a high entropy has been found

entropy

0.993667803215

description

Overall entropy of this PE file is high

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 events)

Bkav	W32.AIDetectMalware.CS
CAT-QuickHeal	Trojan.Ghanarava.1662730481dbb341
Skyhigh	BehavesLike.Win32.Generic.tc
ALYac	Trojan.GenericFCA.Agent.127019
Cylance	Unsafe
VIPRE	Trojan.GenericFCA.Agent.127019
Sangfor	Riskware.Msil.Sharphound.V3k1
CrowdStrike	win/grayware_confidence_90% (D)
BitDefender	Trojan.GenericFCA.Agent.127019
K7GW	Trojan ( 005a8b491 )
K7AntiVirus	Trojan ( 005a8b491 )
Arcabit	Trojan.GenericFCA.Agent.D1F02B
VirIT	HackTool.Win32.Genus.BEW
Symantec	Hacktool.SharpHound
Elastic	Windows.Hacktool.SharpHound
ESET-NOD32	a variant of MSIL/Riskware.SharpHound.G
APEX	Malicious
Avast	Win32:HacktoolX-gen [Trj]
ClamAV	Win.Tool.Sharphound-10034059-0
Kaspersky	HEUR:HackTool.MSIL.SharpHound.gen
Alibaba	HackTool:MSIL/SharpHound.caf8df4a
SUPERAntiSpyware	Hack.Tool/Gen-SharpHound
MicroWorld-eScan	Trojan.GenericFCA.Agent.127019
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:RJtUZti3XZWF3fPSOHYX2g)
Emsisoft	Trojan.GenericFCA.Agent.127019 (B)
F-Secure	HackTool:W32/SharpHound.BA
DrWeb	Tool.SharpHoundNET.1
Zillya	Tool.SharpHound.Win32.2
TrendMicro	HackTool.MSIL.BloodHound.H
McAfeeD	ti!1F74ED6E6188
CTX	exe.hacktool.sharphound
Sophos	ATK/BloodH-F
SentinelOne	Static AI - Malicious PE
FireEye	Trojan.GenericFCA.Agent.127019
Jiangmin	HackTool.MSIL.azuf
Webroot	W32.Riskware.Sharphound
Google	Detected
Avira	APPL/Redcap.1f74ed
Antiy-AVL	RiskWare/MSIL.Sharphound
Kingsoft	Win32.Riskware.Generic.f
Gridinsoft	Hack.Win32.Patcher.cl
Xcitium	ApplicUnwnt@#2yqxf3enqj7f1
Microsoft	HackTool:MSIL/SharpHound!MSR
GData	MSIL.Riskware.Sharphound.A
Varist	W32/MSIL_Agent.GOI.gen!Eldorado
AhnLab-V3	HackTool/Win.SharpHound.C5207316
McAfee	SharpHound
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Trojan.MSIL.Krypt

SharpHound.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All