c81b938c0ce2a366042d9b02204847c22613f4ef335bd98ec8d8ad65399e5031

Analysis

max time kernel
135s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 10:27

Target

c81b938c0ce2a366042d9b02204847c22613f4ef335bd98ec8d8ad65399e5031.exe
Size

453KB
MD5

456c064391e56a516803ed57fce87d9a
SHA1

0eb81bbb545d408b41d37be1afdcaedce4ab0ed0
SHA256

c81b938c0ce2a366042d9b02204847c22613f4ef335bd98ec8d8ad65399e5031
SHA512

f56951db356def848ae044172dce76fe9c2e8e07758473defb2b8c6511728872de262db3d44dec93ab98011c4bc2842fb4fc983c48f87c967e56b69129bd4ca4
SSDEEP

6144:cvaqS4IR/kviXzd4N6qJFldlibYOlU/glqmOgDVL5ul94BhunZQpLzms7VFPZYt:T/kviXzdyGYr/eDVL5ul2unZatY

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2620	qfjesjluewfgfyu.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	qfjesjluewfgfyu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2620	qfjesjluewfgfyu.exe
2620	qfjesjluewfgfyu.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2620	5072	c81b938c0ce2a366042d9b02204847c22613f4ef335bd98ec8d8ad65399e5031.exe	81
PID 5072 wrote to memory of 2620	5072	c81b938c0ce2a366042d9b02204847c22613f4ef335bd98ec8d8ad65399e5031.exe	81

C:\Users\Admin\AppData\Local\Temp\c81b938c0ce2a366042d9b02204847c22613f4ef335bd98ec8d8ad65399e5031.exe
"C:\Users\Admin\AppData\Local\Temp\c81b938c0ce2a366042d9b02204847c22613f4ef335bd98ec8d8ad65399e5031.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\qfjesjluewfgfyu.exe
  "C:\Users\Admin\AppData\Local\Temp\\qfjesjluewfgfyu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2620

C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
453KB

MD5
456c064391e56a516803ed57fce87d9a

SHA1
0eb81bbb545d408b41d37be1afdcaedce4ab0ed0

SHA256
c81b938c0ce2a366042d9b02204847c22613f4ef335bd98ec8d8ad65399e5031

SHA512
f56951db356def848ae044172dce76fe9c2e8e07758473defb2b8c6511728872de262db3d44dec93ab98011c4bc2842fb4fc983c48f87c967e56b69129bd4ca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\qfjesjluewfgfyu.exe

Filesize
11KB

MD5
9a7e17351f0e74570b387600922e59e0

SHA1
017bf40ae2cb8321ee9825e3b93339fd41a148da

SHA256
44b9e76377582e04cc2fdc0c6b922634bcda5f9304419ddeac2833610249cc6c

SHA512
bb0bef29d7b60307bf77a81a358d55a7483b1fa81ed3e9453898b1d7629bd1ecab7ec92c505d6522f887549b4604edcdc8a5547b21f66b5c46b84169522f3ba3

Download Submit
memory/2620-132-0x0000000000000000-mapping.dmp

Download
memory/2620-134-0x00007FF831EB0000-0x00007FF8328E6000-memory.dmp

Filesize
10.2MB

Download
memory/2620-136-0x00000000009FA000-0x00000000009FF000-memory.dmp

Filesize
20KB

Download
memory/2620-137-0x00000000009FA000-0x00000000009FF000-memory.dmp

Filesize
20KB

Download