dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 02:41

Target

dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe
Size

453KB
MD5

4f3a02e848cfb7dab3f5bbaacc58a298
SHA1

0e4cc0b4884b7f129f6acedd8832bafd6ce7b7c2
SHA256

dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102
SHA512

48c4d75410f10d8c9425d713810309678c332c148ddff1483d182d4c40a1c3f35abdb5b3f85e338d5e2751f3ae3f3defd9c16ba44b46cae38307c8bc935e9c77
SSDEEP

6144:cvaqS4IR/kviXzd4N6qJFldlibYOlU/glqmOgDVL5ul94BhunZQpLzms7VFPZYW:T/kviXzdyGYr/eDVL5ul2unZatP

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1636	qfjesjluewfgfyu.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	qfjesjluewfgfyu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1636	qfjesjluewfgfyu.exe
1636	qfjesjluewfgfyu.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1636	1788	dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe	79
PID 1788 wrote to memory of 1636	1788	dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe	79

C:\Users\Admin\AppData\Local\Temp\dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe
"C:\Users\Admin\AppData\Local\Temp\dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\qfjesjluewfgfyu.exe
  "C:\Users\Admin\AppData\Local\Temp\\qfjesjluewfgfyu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1636

C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
453KB

MD5
4f3a02e848cfb7dab3f5bbaacc58a298

SHA1
0e4cc0b4884b7f129f6acedd8832bafd6ce7b7c2

SHA256
dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102

SHA512
48c4d75410f10d8c9425d713810309678c332c148ddff1483d182d4c40a1c3f35abdb5b3f85e338d5e2751f3ae3f3defd9c16ba44b46cae38307c8bc935e9c77

Download Submit
C:\Users\Admin\AppData\Local\Temp\qfjesjluewfgfyu.exe

Filesize
11KB

MD5
9a7e17351f0e74570b387600922e59e0

SHA1
017bf40ae2cb8321ee9825e3b93339fd41a148da

SHA256
44b9e76377582e04cc2fdc0c6b922634bcda5f9304419ddeac2833610249cc6c

SHA512
bb0bef29d7b60307bf77a81a358d55a7483b1fa81ed3e9453898b1d7629bd1ecab7ec92c505d6522f887549b4604edcdc8a5547b21f66b5c46b84169522f3ba3

Download Submit
memory/1636-134-0x00007FFBC73C0000-0x00007FFBC7DF6000-memory.dmp

Filesize
10.2MB

Download
memory/1636-136-0x000000000171A000-0x000000000171F000-memory.dmp

Filesize
20KB

Download
memory/1636-137-0x000000000171A000-0x000000000171F000-memory.dmp

Filesize
20KB

Download