4fbd11e999ba3229b6e17a2431c6c1a199a5355d90f90ee7d2fe95ab7c7013f4

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 05:58

Target

4fbd11e999ba3229b6e17a2431c6c1a199a5355d90f90ee7d2fe95ab7c7013f4.exe
Size

25KB
MD5

6346c6c310620669816b4a499a4854bd
SHA1

72d8f78fc66d897d5a34591accd779a336374af2
SHA256

4fbd11e999ba3229b6e17a2431c6c1a199a5355d90f90ee7d2fe95ab7c7013f4
SHA512

f30c1f47401d0ae6f35bfcbc808c3ef9c22f1bdf78f156b2e87a2a531b735dfbdcd0f86286d41f76490cfbde71d53171eddfc9b0033edc8848df79c2dd0b9374
SSDEEP

384:KMMtyNUXRkRAiu9PbX2yl8W/8AoWqulXyqyQFxH/f4kVdjaLacmkC0GJsJxXSoV6:aW2GAIBQFxfftjaLacmkLGKZSh

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\systemInfomations.ini	4fbd11e999ba3229b6e17a2431c6c1a199a5355d90f90ee7d2fe95ab7c7013f4.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	4fbd11e999ba3229b6e17a2431c6c1a199a5355d90f90ee7d2fe95ab7c7013f4.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4236	4956	4fbd11e999ba3229b6e17a2431c6c1a199a5355d90f90ee7d2fe95ab7c7013f4.exe	83
PID 4956 wrote to memory of 4236	4956	4fbd11e999ba3229b6e17a2431c6c1a199a5355d90f90ee7d2fe95ab7c7013f4.exe	83

C:\Users\Admin\AppData\Local\Temp\4fbd11e999ba3229b6e17a2431c6c1a199a5355d90f90ee7d2fe95ab7c7013f4.exe
"C:\Users\Admin\AppData\Local\Temp\4fbd11e999ba3229b6e17a2431c6c1a199a5355d90f90ee7d2fe95ab7c7013f4.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Modifies registry class
  PID:4236