ed1f2ac1ad6543e4bab63986269c5d9c7ac94ce676084064f44fcbcb97e716bd

Analysis

max time kernel
128s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 13:10

Target

ed1f2ac1ad6543e4bab63986269c5d9c7ac94ce676084064f44fcbcb97e716bd.exe
Size

141KB
MD5

681d4812e768ead9d82cd3f4f5e05190
SHA1

a049b559e8e7a09126fe07bab743c6e9cab6e86b
SHA256

ed1f2ac1ad6543e4bab63986269c5d9c7ac94ce676084064f44fcbcb97e716bd
SHA512

8032b1d78e05ba1e3efd55ccbe7beb68817a272a6546ec1be5eb210cc0806b02b13969717798291b06c50eaff08d2ad29321682300ab4d773b37cba8a50935e3
SSDEEP

3072:OMDGOI4lS9I2MD9BxjtzPWtTVzCGDcaN9dGku6V:XDoT9IPxpPcVzCGDcajdnu6V

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
460	pclt32.exe
5052	pclt32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pclt32.exe	ed1f2ac1ad6543e4bab63986269c5d9c7ac94ce676084064f44fcbcb97e716bd.exe
File created	C:\Windows\SysWOW64\pclt32.exe	ed1f2ac1ad6543e4bab63986269c5d9c7ac94ce676084064f44fcbcb97e716bd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5052	pclt32.exe
5052	pclt32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	pclt32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 460	4976	ed1f2ac1ad6543e4bab63986269c5d9c7ac94ce676084064f44fcbcb97e716bd.exe	82
PID 4976 wrote to memory of 460	4976	ed1f2ac1ad6543e4bab63986269c5d9c7ac94ce676084064f44fcbcb97e716bd.exe	82
PID 4976 wrote to memory of 460	4976	ed1f2ac1ad6543e4bab63986269c5d9c7ac94ce676084064f44fcbcb97e716bd.exe	82

C:\Users\Admin\AppData\Local\Temp\ed1f2ac1ad6543e4bab63986269c5d9c7ac94ce676084064f44fcbcb97e716bd.exe
"C:\Users\Admin\AppData\Local\Temp\ed1f2ac1ad6543e4bab63986269c5d9c7ac94ce676084064f44fcbcb97e716bd.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\pclt32.exe
  C:\Windows\system32\pclt32.exe -d "C:\Users\Admin\AppData\Local\Temp\ed1f2ac1ad6543e4bab63986269c5d9c7ac94ce676084064f44fcbcb97e716bd.exe"
  2⤵
  - Executes dropped EXE
  PID:460

C:\Windows\SysWOW64\pclt32.exe

Filesize
141KB

MD5
5141d56457d0bc4d825ef30fffefa355

SHA1
93fa419376401eb25686a4912b3aa24ec2deae65

SHA256
daf01a03542764e420bde5636b7f7f4494849f3233f87ad1e27114a36cc9e681

SHA512
6d4308037b5f54c9462289dfe17c43e88b30458a454280f03d29a3c1f6a60cc927930826975c0bc09d056339e90cbe588bc080b0c46ab244dba2d471efc5b09d

Download Submit
C:\Windows\SysWOW64\pclt32.exe

Filesize
141KB

MD5
5141d56457d0bc4d825ef30fffefa355

SHA1
93fa419376401eb25686a4912b3aa24ec2deae65

SHA256
daf01a03542764e420bde5636b7f7f4494849f3233f87ad1e27114a36cc9e681

SHA512
6d4308037b5f54c9462289dfe17c43e88b30458a454280f03d29a3c1f6a60cc927930826975c0bc09d056339e90cbe588bc080b0c46ab244dba2d471efc5b09d

Download Submit
C:\Windows\SysWOW64\pclt32.exe

Filesize
141KB

MD5
5141d56457d0bc4d825ef30fffefa355

SHA1
93fa419376401eb25686a4912b3aa24ec2deae65

SHA256
daf01a03542764e420bde5636b7f7f4494849f3233f87ad1e27114a36cc9e681

SHA512
6d4308037b5f54c9462289dfe17c43e88b30458a454280f03d29a3c1f6a60cc927930826975c0bc09d056339e90cbe588bc080b0c46ab244dba2d471efc5b09d

Download Submit