b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65

Analysis

max time kernel
41s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:38

Target

b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65.exe
Size

48KB
MD5

8ede442ad4c3b82deb74a4713a141e50
SHA1

47e43c69b238b175f39c01f119c4b4b1f11d69a5
SHA256

b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65
SHA512

c3fb68c5a5dc593e7ec33cd8f8776eddac094779c64a7cc697b1b1accbde57d10ad23061a71cdf1cf3dc2a1c5e0d3d11022496bef0ca984f8a2f0040df713a13
SSDEEP

768:T8mYzyN7c9SKiGsU8fKKVuJvSZlNyHg95fppiovz/HC8kEW3DmMb8D:GGN7c9SKiGN8fzrlNyHm5P/Hoc

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
292	kemuas.exe

Deletes itself 1 IoCs

pid	Process
568	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kemuas.exe	b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65.exe
File opened for modification	C:\Windows\SysWOW64\kemuas.exe	b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 292 set thread context of 1128	292	kemuas.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2036	b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 292 wrote to memory of 1128	292	kemuas.exe	29
PID 292 wrote to memory of 1128	292	kemuas.exe	29
PID 292 wrote to memory of 1128	292	kemuas.exe	29
PID 292 wrote to memory of 1128	292	kemuas.exe	29
PID 292 wrote to memory of 1128	292	kemuas.exe	29
PID 292 wrote to memory of 1128	292	kemuas.exe	29
PID 2036 wrote to memory of 568	2036	b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65.exe	30
PID 2036 wrote to memory of 568	2036	b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65.exe	30
PID 2036 wrote to memory of 568	2036	b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65.exe	30
PID 2036 wrote to memory of 568	2036	b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65.exe	30

C:\Users\Admin\AppData\Local\Temp\b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65.exe
"C:\Users\Admin\AppData\Local\Temp\b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\B70D5E~1.EXE > nul
  2⤵
  - Deletes itself
  PID:568

C:\Windows\SysWOW64\kemuas.exe

Filesize
48KB

MD5
8ede442ad4c3b82deb74a4713a141e50

SHA1
47e43c69b238b175f39c01f119c4b4b1f11d69a5

SHA256
b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65

SHA512
c3fb68c5a5dc593e7ec33cd8f8776eddac094779c64a7cc697b1b1accbde57d10ad23061a71cdf1cf3dc2a1c5e0d3d11022496bef0ca984f8a2f0040df713a13

Download Submit
C:\Windows\SysWOW64\kemuas.exe

Filesize
48KB

MD5
8ede442ad4c3b82deb74a4713a141e50

SHA1
47e43c69b238b175f39c01f119c4b4b1f11d69a5

SHA256
b70d5e3628500c846da1b26374ca5735dddac2c8334283d11ebf6879ed84cd65

SHA512
c3fb68c5a5dc593e7ec33cd8f8776eddac094779c64a7cc697b1b1accbde57d10ad23061a71cdf1cf3dc2a1c5e0d3d11022496bef0ca984f8a2f0040df713a13

Download Submit
memory/1128-60-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1128-58-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2036-54-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download