e4afa0ba3584b9057b85661836f3dce7b16e5fa2a47ba4b804126717959db4c6

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2023, 02:23

Target

e4afa0ba3584b9057b85661836f3dce7b16e5fa2a47ba4b804126717959db4c6.exe
Size

3.7MB
MD5

c92fa4f6dd73e057e800dcf7d493852a
SHA1

5fa49456bb3f962e0fcc6434bc66edf9c29859ad
SHA256

e4afa0ba3584b9057b85661836f3dce7b16e5fa2a47ba4b804126717959db4c6
SHA512

5a4ba24cea9a5c88970064eb4773cd385c1b7a3ce032e4ba5ed74f5d87fe0088ac60708f9e9b7799e7f862911e2de7010f7a8896b7641a2613ec7cadc55d48a4
SSDEEP

49152:e3etBMu02PQwU2kF2EAwhsVPM7Z9pzAYBR0bBc+/4OsQt3YC7+Hbnt0NR0bBc+:SGx02PQwU2kF2EAwh2QZ9pSl+Hb

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4396	aow_dr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	e4afa0ba3584b9057b85661836f3dce7b16e5fa2a47ba4b804126717959db4c6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2476	e4afa0ba3584b9057b85661836f3dce7b16e5fa2a47ba4b804126717959db4c6.exe
2476	e4afa0ba3584b9057b85661836f3dce7b16e5fa2a47ba4b804126717959db4c6.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4396	2476	e4afa0ba3584b9057b85661836f3dce7b16e5fa2a47ba4b804126717959db4c6.exe	86
PID 2476 wrote to memory of 4396	2476	e4afa0ba3584b9057b85661836f3dce7b16e5fa2a47ba4b804126717959db4c6.exe	86

C:\Users\Admin\AppData\Local\Temp\e4afa0ba3584b9057b85661836f3dce7b16e5fa2a47ba4b804126717959db4c6.exe
"C:\Users\Admin\AppData\Local\Temp\e4afa0ba3584b9057b85661836f3dce7b16e5fa2a47ba4b804126717959db4c6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\Temp\aow_dr.exe
  C:\Users\Admin\AppData\Local\Temp\aow_dr.exe
  2⤵
  - Executes dropped EXE
  PID:4396

C:\Users\Admin\AppData\Local\Temp\aow_dr.exe

Filesize
14KB

MD5
a3b6eae67f98f0493d27350c09fa85c8

SHA1
04a301311c382aaa78791aafd0407d4cca7d0d0f

SHA256
05a864056055780e214ea7a182aa83f1089680120486a56c013f6238d1d146af

SHA512
ebd274ab74dabd03e620c0b22891ed9edbd9ec3a8f4e17518575b7ee649bc1c815141b416a504ca86734577a81c1a611af7102cfc5f5aa2ff8d04fe41f7cc250

Download Submit
C:\Users\Admin\AppData\Local\Temp\aow_dr.exe

Filesize
14KB

MD5
a3b6eae67f98f0493d27350c09fa85c8

SHA1
04a301311c382aaa78791aafd0407d4cca7d0d0f

SHA256
05a864056055780e214ea7a182aa83f1089680120486a56c013f6238d1d146af

SHA512
ebd274ab74dabd03e620c0b22891ed9edbd9ec3a8f4e17518575b7ee649bc1c815141b416a504ca86734577a81c1a611af7102cfc5f5aa2ff8d04fe41f7cc250

Download Submit
C:\Users\Admin\AppData\Local\Temp\dr.dll

Filesize
336B

MD5
c26c8f646a1866adaa9cd344df3e1236

SHA1
b0cdbd06a88e32d7dafc114a2f6f47eaac3e4e27

SHA256
d0a4c0e63a1c205fedbe667ff4ab01921e79838feb3fec8d055139e5b2ac7707

SHA512
f097107ab0c78f0ea15b26f11d714a7e7051edeec636da9edfe988e58a216e7f8edb3ed5704c6e81c0597b1e865cedf829dfce95bc701869adad750faa1f63ab

Download Submit