75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97

Analysis

max time kernel
147s
max time network
159s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 00:54

Target

75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe
Size

15KB
MD5

90ec6ddc5c841d1293face3c719035c0
SHA1

b8b550bb0076821d30ce75a721a5f998330581ab
SHA256

75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97
SHA512

bdaf4cad91607cc9d49d24a39051d560f32e1bc9bfbfd5eec41661b1f501cb6bf9432fa088295ee8dba7c33a9c888509ecaeee6fc8049b20e74a287b46797c56
SSDEEP

384:Po4baoJs+xoq6BIy+FrGDgtSyqyHn8SR:Quf6yyzgbH8W

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1540	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe

Deletes itself 1 IoCs

pid	Process
552	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe
File opened for modification	C:\Windows\SysWOW64\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1724	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 552	1724	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe	28
PID 1724 wrote to memory of 552	1724	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe	28
PID 1724 wrote to memory of 552	1724	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe	28
PID 1724 wrote to memory of 552	1724	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe	28

C:\Users\Admin\AppData\Local\Temp\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe
"C:\Users\Admin\AppData\Local\Temp\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\75221F~1.EXE > nul
  2⤵
  - Deletes itself
  PID:552

C:\Windows\SysWOW64\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe
C:\Windows\SysWOW64\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe
1⤵
- Executes dropped EXE
PID:1540

C:\Windows\SysWOW64\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe

Filesize
15KB

MD5
90ec6ddc5c841d1293face3c719035c0

SHA1
b8b550bb0076821d30ce75a721a5f998330581ab

SHA256
75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97

SHA512
bdaf4cad91607cc9d49d24a39051d560f32e1bc9bfbfd5eec41661b1f501cb6bf9432fa088295ee8dba7c33a9c888509ecaeee6fc8049b20e74a287b46797c56

Download Submit
memory/1724-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download