52a6bede9118bda5d1699b5f3f6f80b22808691419dd5070975621529b28de40

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 18:57

Target

WareHub_Cw4ck_By_discord.gg_Recte/IGNORE-THIS-FOLDER/a
Size

137KB
MD5

ba8dd704aec13e3b16cfd650592556d5
SHA1

2a629e2d367b0586ba25a60cc645024028350d76
SHA256

aab6e7dfe3fa196e2e86556ae1e590b2164f8eae897fc2c9a3fe8b75991cb6be
SHA512

1de5ccff68494dc30d9fbcc49d23f414f0a814217ba69385611530d410e55bb8bf36f714d15af968b7243de7e62d19240b9befd2e75612845ecf9446b80c77ac
SSDEEP

3072:Ov9iup2AUCGJdL8soYOtGw8XEnJJX45bOS/SdAJt9vBhTWOHdwxZAqJE/:2ECUDUd455/Skt9ZxN8ZAd

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2920	a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	a.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 2920	336	cmd.exe	91
PID 336 wrote to memory of 2920	336	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\WareHub_Cw4ck_By_discord.gg_Recte\IGNORE-THIS-FOLDER\a
1⤵
- Suspicious use of WriteProcessMemory
PID:336
- C:\Users\Admin\AppData\Local\Temp\WareHub_Cw4ck_By_discord.gg_Recte\IGNORE-THIS-FOLDER\a.exe
  C:\Users\Admin\AppData\Local\Temp\WareHub_Cw4ck_By_discord.gg_Recte\IGNORE-THIS-FOLDER\a
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920

memory/2920-0-0x0000000000890000-0x000000000089A000-memory.dmp

Filesize
40KB

Download
memory/2920-1-0x0000000002910000-0x000000000291C000-memory.dmp

Filesize
48KB

Download
memory/2920-2-0x00007FF95A460000-0x00007FF95AF21000-memory.dmp

Filesize
10.8MB

Download
memory/2920-5-0x00007FF95A460000-0x00007FF95AF21000-memory.dmp

Filesize
10.8MB

Download