849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef

Analysis

max time kernel
149s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2022 01:15

Target

849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe
Size

471KB
MD5

734ed36c4ec735963fd147bdb57d2b40
SHA1

180303531417fa1f28a00a839b68dd02e4d1a33f
SHA256

849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef
SHA512

57f343aa6c3b3283497cda5b0df441c9d67a6c60da11498c22fc7705abb6b407c11c1d1913eedb4951afe557e4ffb217160ff7ef373c4c3ef1ab6a85e4e2ef46
SSDEEP

12288:xcN1zZoi11kIDIFmgzniA1EG3kUQymK9Dloj:uZoiPBDIFniAuG1I

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
5036	tvsliabumveefmz.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	tvsliabumveefmz.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5036	tvsliabumveefmz.exe
5036	tvsliabumveefmz.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 5036	4244	849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe	81
PID 4244 wrote to memory of 5036	4244	849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe	81

C:\Users\Admin\AppData\Local\Temp\849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe
"C:\Users\Admin\AppData\Local\Temp\849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Temp\tvsliabumveefmz.exe
  "C:\Users\Admin\AppData\Local\Temp\\tvsliabumveefmz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5036

C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
471KB

MD5
734ed36c4ec735963fd147bdb57d2b40

SHA1
180303531417fa1f28a00a839b68dd02e4d1a33f

SHA256
849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef

SHA512
57f343aa6c3b3283497cda5b0df441c9d67a6c60da11498c22fc7705abb6b407c11c1d1913eedb4951afe557e4ffb217160ff7ef373c4c3ef1ab6a85e4e2ef46

Download Submit
C:\Users\Admin\AppData\Local\Temp\tvsliabumveefmz.exe

Filesize
19KB

MD5
27b5e4d4fe804e60cc6d7f1a1f9e8c04

SHA1
9dfe639b3cc4dfd44d9537a0bca46fd39b3dbc52

SHA256
f212f6658340c5d81b686866afce671cb71d2f0308d9f1e31b7ee01b74c84eda

SHA512
275c865d05c98bbf60c29b40978586a91569471217fa2ef5d44741ac1a535f5e0295e1e2f666e8ddaaa6e7dcf3cd869a41ed62481e0da9541fdb63bc0db6cee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tvsliabumveefmz.exe

Filesize
19KB

MD5
27b5e4d4fe804e60cc6d7f1a1f9e8c04

SHA1
9dfe639b3cc4dfd44d9537a0bca46fd39b3dbc52

SHA256
f212f6658340c5d81b686866afce671cb71d2f0308d9f1e31b7ee01b74c84eda

SHA512
275c865d05c98bbf60c29b40978586a91569471217fa2ef5d44741ac1a535f5e0295e1e2f666e8ddaaa6e7dcf3cd869a41ed62481e0da9541fdb63bc0db6cee7

Download Submit
memory/5036-132-0x0000000000000000-mapping.dmp

Download
memory/5036-135-0x00007FFD87B40000-0x00007FFD88576000-memory.dmp

Filesize
10.2MB

Download
memory/5036-137-0x00000000008AA000-0x00000000008AF000-memory.dmp

Filesize
20KB

Download
memory/5036-138-0x00000000008AA000-0x00000000008AF000-memory.dmp

Filesize
20KB

Download