c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384

Analysis

max time kernel
56s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:13

Target

c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe
Size

42KB
MD5

43045aaeb2c5c2f821a4dd27514498f8
SHA1

4342bf5e5fc36e0727da72d13a2748dd3e208a93
SHA256

c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384
SHA512

62ff3a719fb25c167a4cc7af77b19409e11d8dcc3c2cf1e78ce9e81a81cde39c822475dc75ed37f85a3752141d85150c4c0d32d88890f369b3c8aee436a5199e
SSDEEP

768:1qVXHWSJvoqzewxRha5ONYHPHAqqoecDyhKJE4OVR7NB6DyT6t1zzzzJrzzzzzg0:QV3WSNoqtSHPH4o3DyAO3JBAyTizzzz3

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

WinHelp32.exe

pid process

1060 WinHelp32.exe

pid	process
1060	WinHelp32.exe

Drops file in System32 directory 3 IoCs

Processes:

c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exeWinHelp32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\WinHelp32.exe	c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe
File created	C:\Windows\SysWOW64\WinHelp32.exe	WinHelp32.exe
File created	C:\Windows\SysWOW64\WinHelp32.exe	c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exeWinHelp32.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	4460	c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe
Token: SeIncBasePriorityPrivilege	1060	WinHelp32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe

description	pid	process	target process
PID 4460 wrote to memory of 1060	4460	c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe	WinHelp32.exe
PID 4460 wrote to memory of 1060	4460	c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe	WinHelp32.exe
PID 4460 wrote to memory of 1060	4460	c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe	WinHelp32.exe

C:\Windows\SysWOW64\WinHelp32.exe
Filesize
42KB

MD5
43045aaeb2c5c2f821a4dd27514498f8

SHA1
4342bf5e5fc36e0727da72d13a2748dd3e208a93

SHA256
c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384

SHA512
62ff3a719fb25c167a4cc7af77b19409e11d8dcc3c2cf1e78ce9e81a81cde39c822475dc75ed37f85a3752141d85150c4c0d32d88890f369b3c8aee436a5199e

Download Submit
C:\Windows\SysWOW64\WinHelp32.exe
Filesize
42KB

MD5
43045aaeb2c5c2f821a4dd27514498f8

SHA1
4342bf5e5fc36e0727da72d13a2748dd3e208a93

SHA256
c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384

SHA512
62ff3a719fb25c167a4cc7af77b19409e11d8dcc3c2cf1e78ce9e81a81cde39c822475dc75ed37f85a3752141d85150c4c0d32d88890f369b3c8aee436a5199e

Download Submit
memory/1060-133-0x0000000000000000-mapping.dmp

Download
memory/4460-132-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download