6bab5bfaee8b763f5abd11b5d8c7a0578f01200d8aa1d124c53c6c270845dd12

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 11:26

Target

6bab5bfaee8b763f5abd11b5d8c7a0578f01200d8aa1d124c53c6c270845dd12.exe
Size

471KB
MD5

cbc9bc011d8719d5497eee87a2662510
SHA1

fc4566ef48befaaffdbe1f0ebc866686c2a28e49
SHA256

6bab5bfaee8b763f5abd11b5d8c7a0578f01200d8aa1d124c53c6c270845dd12
SHA512

dcc7748118e21eebeb44d6ac5acebd25370a4d67a111afb231849043e45e5cc514fe87d7c9b74cecab124c398312f9257d996e64340e5b82c9aad80f0f90d82d
SSDEEP

6144:M5fYH5EeQRFT7Zoi1jY0Ie++M0vLvsZ2tsR6lRStFaYcr/bK+gGfZBZoKQJrV51k:vQR17Zoi1LIeJMsvsrcl0tQRZydVnA

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4980	wgapeuvubjtcez.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	wgapeuvubjtcez.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4980	wgapeuvubjtcez.exe
4980	wgapeuvubjtcez.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 4980	1724	6bab5bfaee8b763f5abd11b5d8c7a0578f01200d8aa1d124c53c6c270845dd12.exe	81
PID 1724 wrote to memory of 4980	1724	6bab5bfaee8b763f5abd11b5d8c7a0578f01200d8aa1d124c53c6c270845dd12.exe	81

C:\Users\Admin\AppData\Local\Temp\6bab5bfaee8b763f5abd11b5d8c7a0578f01200d8aa1d124c53c6c270845dd12.exe
"C:\Users\Admin\AppData\Local\Temp\6bab5bfaee8b763f5abd11b5d8c7a0578f01200d8aa1d124c53c6c270845dd12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\wgapeuvubjtcez.exe
  "C:\Users\Admin\AppData\Local\Temp\\wgapeuvubjtcez.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4980

C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
471KB

MD5
cbc9bc011d8719d5497eee87a2662510

SHA1
fc4566ef48befaaffdbe1f0ebc866686c2a28e49

SHA256
6bab5bfaee8b763f5abd11b5d8c7a0578f01200d8aa1d124c53c6c270845dd12

SHA512
dcc7748118e21eebeb44d6ac5acebd25370a4d67a111afb231849043e45e5cc514fe87d7c9b74cecab124c398312f9257d996e64340e5b82c9aad80f0f90d82d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wgapeuvubjtcez.exe

Filesize
19KB

MD5
41b6199415075e5e59f766b80f0de9d0

SHA1
8dee026bd21eb2835a31707300879e3d5c3fdaef

SHA256
9d97f6539209d1482e8510bc40a8bff668e7863adee6ebf51a46e6e912d585b5

SHA512
3f5c38cb855d7319b737f1cafb0b9b51fa93b12a91b8c35cd04e4a816dc2c5e8dc26dc50d0c653ddb037a75e6a560b2cbf618c74e013bf4ea6e90188bf3d4af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wgapeuvubjtcez.exe

Filesize
19KB

MD5
41b6199415075e5e59f766b80f0de9d0

SHA1
8dee026bd21eb2835a31707300879e3d5c3fdaef

SHA256
9d97f6539209d1482e8510bc40a8bff668e7863adee6ebf51a46e6e912d585b5

SHA512
3f5c38cb855d7319b737f1cafb0b9b51fa93b12a91b8c35cd04e4a816dc2c5e8dc26dc50d0c653ddb037a75e6a560b2cbf618c74e013bf4ea6e90188bf3d4af2

Download Submit
memory/4980-132-0x0000000000000000-mapping.dmp

Download
memory/4980-135-0x00007FF9620D0000-0x00007FF962B06000-memory.dmp

Filesize
10.2MB

Download
memory/4980-137-0x0000000000AAA000-0x0000000000AAF000-memory.dmp

Filesize
20KB

Download
memory/4980-138-0x0000000000AAA000-0x0000000000AAF000-memory.dmp

Filesize
20KB

Download