cd1ee815898696a2ee20df5578aab350a93df45a7f47b22e6de8ebe8de0849b5

Analysis

max time kernel
145s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 18:07

Target

cd1ee815898696a2ee20df5578aab350a93df45a7f47b22e6de8ebe8de0849b5.exe
Size

470KB
MD5

56f02f2661f98044291ac983643a271a
SHA1

edcaaa2f2b3600efa89b4d9f5e164589dc2a31fd
SHA256

cd1ee815898696a2ee20df5578aab350a93df45a7f47b22e6de8ebe8de0849b5
SHA512

14014550e9982b0572a7f93563704f789be4e08332ea71ec774515e88253ec35dc85bbb54c4be503d4e5908cc5a6ec77515afc3f26407f121d2a9d43979b46fa
SSDEEP

12288:GQduZgCDOfyZBnC+QRWNHsQGF0pcsMTXgQmz9eNLqjY:YZgCD9C+EWNML2pcsM7YReojY

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1200	zmkkghwlhsdjiuf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	zmkkghwlhsdjiuf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1200	zmkkghwlhsdjiuf.exe
1200	zmkkghwlhsdjiuf.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 1200	376	cd1ee815898696a2ee20df5578aab350a93df45a7f47b22e6de8ebe8de0849b5.exe	79
PID 376 wrote to memory of 1200	376	cd1ee815898696a2ee20df5578aab350a93df45a7f47b22e6de8ebe8de0849b5.exe	79

C:\Users\Admin\AppData\Local\Temp\cd1ee815898696a2ee20df5578aab350a93df45a7f47b22e6de8ebe8de0849b5.exe
"C:\Users\Admin\AppData\Local\Temp\cd1ee815898696a2ee20df5578aab350a93df45a7f47b22e6de8ebe8de0849b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:376
- C:\Users\Admin\AppData\Local\Temp\zmkkghwlhsdjiuf.exe
  "C:\Users\Admin\AppData\Local\Temp\\zmkkghwlhsdjiuf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1200

C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
470KB

MD5
56f02f2661f98044291ac983643a271a

SHA1
edcaaa2f2b3600efa89b4d9f5e164589dc2a31fd

SHA256
cd1ee815898696a2ee20df5578aab350a93df45a7f47b22e6de8ebe8de0849b5

SHA512
14014550e9982b0572a7f93563704f789be4e08332ea71ec774515e88253ec35dc85bbb54c4be503d4e5908cc5a6ec77515afc3f26407f121d2a9d43979b46fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\zmkkghwlhsdjiuf.exe

Filesize
18KB

MD5
080496d64c7b605530efb40a7bbf9259

SHA1
8e27dcdf5b271c295987c908dfb6ba4d4ab376c4

SHA256
acfc068fcfa5ec65bd8a3e235ada2c6ee86dca3d1d1f866a40c20ad5948a4f87

SHA512
ddc7c2c18e34f27517357584903323f36368736e4c50e342546666dbc369475691834de8ad4028104585199dbb531482ae72ebd9e7235fff46a7c9716bd11402

Download Submit
C:\Users\Admin\AppData\Local\Temp\zmkkghwlhsdjiuf.exe

Filesize
18KB

MD5
080496d64c7b605530efb40a7bbf9259

SHA1
8e27dcdf5b271c295987c908dfb6ba4d4ab376c4

SHA256
acfc068fcfa5ec65bd8a3e235ada2c6ee86dca3d1d1f866a40c20ad5948a4f87

SHA512
ddc7c2c18e34f27517357584903323f36368736e4c50e342546666dbc369475691834de8ad4028104585199dbb531482ae72ebd9e7235fff46a7c9716bd11402

Download Submit
memory/1200-135-0x00007FF8CA490000-0x00007FF8CAEC6000-memory.dmp

Filesize
10.2MB

Download
memory/1200-137-0x000000000142A000-0x000000000142F000-memory.dmp

Filesize
20KB

Download
memory/1200-138-0x000000000142A000-0x000000000142F000-memory.dmp

Filesize
20KB

Download