d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5

Analysis

max time kernel
91s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 18:52

Target

d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe
Size

32KB
MD5

6cf18d70d862b7956662279d1c207ddb
SHA1

84b9cf4104d9af4090d93141c45a0a5605e56c4a
SHA256

d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5
SHA512

77f810650615f1aa10e70708d7bb3f8fa24290e4c99017e556edfe324b08b19b019550384de49482f4fe6f1df2ed0a13e37f7d3e502f1e8aab442ffbc40eb035
SSDEEP

768:tA+eZ9hQ7WcdcXa2jFkbb4vSCTxRGAa3d/GmyfPIJN:tA+sgzdcXa2j2YZ8E3k

Score

8^/10

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\PCIDump.sys	W1nHelp32.exe
File opened for modification	C:\Windows\SysWOW64\drivers\PCIDump.sys	d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe

Executes dropped EXE 1 IoCs

pid	Process
4316	W1nHelp32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\W1nHelp32.exe	W1nHelp32.exe
File created	C:\Windows\SysWOW64\W1nHelp32.exe	d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe
File opened for modification	C:\Windows\SysWOW64\W1nHelp32.exe	d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3404	d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe
Token: SeIncBasePriorityPrivilege	4316	W1nHelp32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4316	3404	d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe	84
PID 3404 wrote to memory of 4316	3404	d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe	84
PID 3404 wrote to memory of 4316	3404	d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe	84
PID 3404 wrote to memory of 4264	3404	d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe	82
PID 3404 wrote to memory of 4264	3404	d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe	82
PID 3404 wrote to memory of 4264	3404	d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe	82
PID 4316 wrote to memory of 2184	4316	W1nHelp32.exe	83
PID 4316 wrote to memory of 2184	4316	W1nHelp32.exe	83
PID 4316 wrote to memory of 2184	4316	W1nHelp32.exe	83

C:\Users\Admin\AppData\Local\Temp\d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe
"C:\Users\Admin\AppData\Local\Temp\d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\D6241A~1.EXE > nul
  2⤵
  PID:4264
- C:\Windows\SysWOW64\W1nHelp32.exe
  "C:\Windows\system32\W1nHelp32.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\W1NHEL~1.EXE > nul
1⤵
PID:2184

C:\Windows\SysWOW64\W1nHelp32.exe

Filesize
32KB

MD5
6cf18d70d862b7956662279d1c207ddb

SHA1
84b9cf4104d9af4090d93141c45a0a5605e56c4a

SHA256
d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5

SHA512
77f810650615f1aa10e70708d7bb3f8fa24290e4c99017e556edfe324b08b19b019550384de49482f4fe6f1df2ed0a13e37f7d3e502f1e8aab442ffbc40eb035

Download Submit
C:\Windows\SysWOW64\W1nHelp32.exe

Filesize
32KB

MD5
6cf18d70d862b7956662279d1c207ddb

SHA1
84b9cf4104d9af4090d93141c45a0a5605e56c4a

SHA256
d6241a963f881115579c7b791625c4246d39c0d3791f2eeeb12cb032165b8ac5

SHA512
77f810650615f1aa10e70708d7bb3f8fa24290e4c99017e556edfe324b08b19b019550384de49482f4fe6f1df2ed0a13e37f7d3e502f1e8aab442ffbc40eb035

Download Submit
C:\Windows\SysWOW64\drivers\PCIDump.sys

Filesize
4KB

MD5
7434b98a847fdcb753d8db6341680db7

SHA1
859816f07486ae2ffdffd56f1ff77677bfd14f2b

SHA256
5947ff34e874e7e455cc441b017b11b63fc4fb315b311766fb83070ea7012259

SHA512
8d8de33e245eadabfb2d111aee51dbb0b64238cc82bc1cdd55a440f0f985466d2090a50c6363960bef09b41dd4bdf5888a2a99d37940211b092112ec5030ab53

Download Submit