ab5045171378d8293da48ff6d1262946c331ceeb2a1c0931dcf1ddd275e9c2c8

Analysis

max time kernel
146s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 10:58

Target

ab5045171378d8293da48ff6d1262946c331ceeb2a1c0931dcf1ddd275e9c2c8.exe
Size

457KB
MD5

8d50185e5f0165469a96c6db5f8a198c
SHA1

e4ecdad27f3fab12a8e1c180c739e55fbe86e47d
SHA256

ab5045171378d8293da48ff6d1262946c331ceeb2a1c0931dcf1ddd275e9c2c8
SHA512

f0c746e73f9757ade050eec1d27c682404aca38d252f7ef63e122db94f8401b6e294ab5e70fc32330f5fc283e9b08ac3e09bc341122ccd7c3f67fa93f62dc98f
SSDEEP

6144:OHFn/5EIFfwnb4ylKxh5Vn5TKLjgp8cAe4WDc46wCWFGmxllgMeN+anWl95YdS:yFfGb41xtn5ufgpLA46w5NlS3Wl9cS

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4496	adgwsukbgauoppf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	adgwsukbgauoppf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4496	adgwsukbgauoppf.exe
4496	adgwsukbgauoppf.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 4496	1052	ab5045171378d8293da48ff6d1262946c331ceeb2a1c0931dcf1ddd275e9c2c8.exe	80
PID 1052 wrote to memory of 4496	1052	ab5045171378d8293da48ff6d1262946c331ceeb2a1c0931dcf1ddd275e9c2c8.exe	80

C:\Users\Admin\AppData\Local\Temp\ab5045171378d8293da48ff6d1262946c331ceeb2a1c0931dcf1ddd275e9c2c8.exe
"C:\Users\Admin\AppData\Local\Temp\ab5045171378d8293da48ff6d1262946c331ceeb2a1c0931dcf1ddd275e9c2c8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Users\Admin\AppData\Local\Temp\adgwsukbgauoppf.exe
  "C:\Users\Admin\AppData\Local\Temp\\adgwsukbgauoppf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4496

C:\Users\Admin\AppData\Local\Temp\adgwsukbgauoppf.exe

Filesize
6KB

MD5
aac5ed13dc19a296da596b37f09809b9

SHA1
9f93e6281386df5ae0525d9d3036cb4a74df4ac4

SHA256
6522244da8cb88bbf07ef2c7bdd81a62daf6e24df39d3c331a31b00d8954790e

SHA512
11e9b499670c97f0e2ab4a0d6ff6952e697d67d43c91ec84be7c817c74dc450ac98ad20cdcfbf2028de97aa69ce13de56a15481b6402b9c9d9dc158a8256ece4

Download Submit
C:\Users\Admin\AppData\Local\Temp\adgwsukbgauoppf.exe

Filesize
6KB

MD5
aac5ed13dc19a296da596b37f09809b9

SHA1
9f93e6281386df5ae0525d9d3036cb4a74df4ac4

SHA256
6522244da8cb88bbf07ef2c7bdd81a62daf6e24df39d3c331a31b00d8954790e

SHA512
11e9b499670c97f0e2ab4a0d6ff6952e697d67d43c91ec84be7c817c74dc450ac98ad20cdcfbf2028de97aa69ce13de56a15481b6402b9c9d9dc158a8256ece4

Download Submit
C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
457KB

MD5
8d50185e5f0165469a96c6db5f8a198c

SHA1
e4ecdad27f3fab12a8e1c180c739e55fbe86e47d

SHA256
ab5045171378d8293da48ff6d1262946c331ceeb2a1c0931dcf1ddd275e9c2c8

SHA512
f0c746e73f9757ade050eec1d27c682404aca38d252f7ef63e122db94f8401b6e294ab5e70fc32330f5fc283e9b08ac3e09bc341122ccd7c3f67fa93f62dc98f

Download Submit
memory/4496-135-0x00007FFBFD760000-0x00007FFBFE196000-memory.dmp

Filesize
10.2MB

Download
memory/4496-137-0x000000000186A000-0x000000000186F000-memory.dmp

Filesize
20KB

Download
memory/4496-138-0x000000000186A000-0x000000000186F000-memory.dmp

Filesize
20KB

Download