52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 02:05

Target

52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d.exe
Size

108KB
MD5

79d616ca784793cc9aa4464674f89330
SHA1

8a34e3a5404e48fc4008d5633d4e4e5fad60d2b1
SHA256

52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d
SHA512

1042131a5fc3ad21b74239df8c50eea81d7cabc2655d6de8fdd7f8e95995c7d3c659b72a5eb7cd1f53ab9f7ab1d2f863cf6666a516cc74f2e93f7c645e710fb1
SSDEEP

768:POPl9ayP+NZ98YNzUJhH3xG+4DRGCBxHDR3Ca8DdnMdHx0ha5/fx3ha5vo167:GPltUz2hHBX4t1l3z8DxMcgPQo167

Score

8^/10

aspackv2

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
behavioral2/files/0x0006000000022637-132.dat	aspack_v212_v242
behavioral2/files/0x0006000000022637-133.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4332	ixjqoh.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ixjqoh.exe	52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d.exe
File opened for modification	C:\Windows\SysWOW64\ixjqoh.exe	52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2040	52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 4276	2040	52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d.exe	80
PID 2040 wrote to memory of 4276	2040	52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d.exe	80
PID 2040 wrote to memory of 4276	2040	52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d.exe	80

C:\Users\Admin\AppData\Local\Temp\52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d.exe
"C:\Users\Admin\AppData\Local\Temp\52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\52FD6F~1.EXE > nul
  2⤵
  PID:4276

C:\Windows\SysWOW64\ixjqoh.exe
C:\Windows\SysWOW64\ixjqoh.exe
1⤵
- Executes dropped EXE
PID:4332

C:\Windows\SysWOW64\ixjqoh.exe

Filesize
108KB

MD5
79d616ca784793cc9aa4464674f89330

SHA1
8a34e3a5404e48fc4008d5633d4e4e5fad60d2b1

SHA256
52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d

SHA512
1042131a5fc3ad21b74239df8c50eea81d7cabc2655d6de8fdd7f8e95995c7d3c659b72a5eb7cd1f53ab9f7ab1d2f863cf6666a516cc74f2e93f7c645e710fb1

Download Submit
C:\Windows\SysWOW64\ixjqoh.exe

Filesize
108KB

MD5
79d616ca784793cc9aa4464674f89330

SHA1
8a34e3a5404e48fc4008d5633d4e4e5fad60d2b1

SHA256
52fd6fbc31fdaab2e13357a441ddc1957764941a45c93ec160f03c7ba437cc1d

SHA512
1042131a5fc3ad21b74239df8c50eea81d7cabc2655d6de8fdd7f8e95995c7d3c659b72a5eb7cd1f53ab9f7ab1d2f863cf6666a516cc74f2e93f7c645e710fb1

Download Submit