5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 18:29

Target

5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe
Size

451KB
MD5

b0e2c156b901a5a87e947fea1ff56316
SHA1

dc3761398275dedca78517dcaa61e281eef1ca51
SHA256

5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e
SHA512

7a25c6b76be11c53748191849f236754947df0d14095f12319120cbbbcfc7dc655d544a85862dcd83f21db46971abd521897378c82cca86a51b43767935ca82d
SSDEEP

6144:SvaqS4IR/kviXzd4twM19AwCflNKBek0egb3CZF8/yoYZeiEzK4NKzLBM4cUvpSp:h/kviXzdtmJwNKBekM3GoYTEDeBf40bI

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3804	hpigpwdrymrp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3804	hpigpwdrymrp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3804	hpigpwdrymrp.exe
3804	hpigpwdrymrp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 3804	644	5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe	80
PID 644 wrote to memory of 3804	644	5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe	80

C:\Users\Admin\AppData\Local\Temp\5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe
"C:\Users\Admin\AppData\Local\Temp\5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp\hpigpwdrymrp.exe
  "C:\Users\Admin\AppData\Local\Temp\\hpigpwdrymrp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3804

C:\Users\Admin\AppData\Local\Temp\hpigpwdrymrp.exe

Filesize
11KB

MD5
8a1240360271b11d7be8e579c8aae55a

SHA1
d5f399cea2aae630772f1090c83b3e3353ed833f

SHA256
81b9fdc86475fe81c05f0feeef0b233e1386802a57c7050f63409181b5feb827

SHA512
f1baf606ef670a94467962d95ab21fcb7257acdc5409d1430d15c2bc03bf7391f76c37a657f9cb0e7420a1cf3c34d430b022e1932701cad4504e7c2f08d0ac81

Download Submit
C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
451KB

MD5
b0e2c156b901a5a87e947fea1ff56316

SHA1
dc3761398275dedca78517dcaa61e281eef1ca51

SHA256
5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e

SHA512
7a25c6b76be11c53748191849f236754947df0d14095f12319120cbbbcfc7dc655d544a85862dcd83f21db46971abd521897378c82cca86a51b43767935ca82d

Download Submit
memory/3804-134-0x00007FFCA9460000-0x00007FFCA9E96000-memory.dmp

Filesize
10.2MB

Download
memory/3804-136-0x000000000183A000-0x000000000183F000-memory.dmp

Filesize
20KB

Download
memory/3804-137-0x000000000183A000-0x000000000183F000-memory.dmp

Filesize
20KB

Download