89d29b4e27f330cc0e3956678164b95aede5dd1efff87b3b02482e4ee9c3aca2

Analysis

max time kernel
309s
max time network
370s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 01:50

Target

89d29b4e27f330cc0e3956678164b95aede5dd1efff87b3b02482e4ee9c3aca2.exe
Size

178KB
MD5

2a2ad4d021d47348c19eaa274e0a6c70
SHA1

fef10b2658bdd6c89a9ca6c0aca70452eceda3c1
SHA256

89d29b4e27f330cc0e3956678164b95aede5dd1efff87b3b02482e4ee9c3aca2
SHA512

890bed1fd4b585d2905fdf6fbfe55b4a0b09b8f0dc47197bed9167742db1cabc8063f51a27c4c72cdb138e43292c4cc75dd1c62f343ab060dfc2e73ed45f057c
SSDEEP

3072:heIccqEwlYcFMhHpfZ7jzprCqMJ5cGomlkzuFsehVu8B3O0d:p/JjVBM8G9oG1B+0d

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 624	4852	89d29b4e27f330cc0e3956678164b95aede5dd1efff87b3b02482e4ee9c3aca2.exe	82
PID 4852 wrote to memory of 624	4852	89d29b4e27f330cc0e3956678164b95aede5dd1efff87b3b02482e4ee9c3aca2.exe	82
PID 4852 wrote to memory of 624	4852	89d29b4e27f330cc0e3956678164b95aede5dd1efff87b3b02482e4ee9c3aca2.exe	82

C:\Users\Admin\AppData\Local\Temp\89d29b4e27f330cc0e3956678164b95aede5dd1efff87b3b02482e4ee9c3aca2.exe
"C:\Users\Admin\AppData\Local\Temp\89d29b4e27f330cc0e3956678164b95aede5dd1efff87b3b02482e4ee9c3aca2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 844
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:624

memory/4852-133-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download