52a6bede9118bda5d1699b5f3f6f80b22808691419dd5070975621529b28de40

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
17-11-2023 18:57

Target

WareHub_Cw4ck_By_discord.gg_Recte/Execute Me In Lobby.exe
Size

90KB
MD5

c5cbe94c0a909f2521b5365989ae3a1a
SHA1

598e081ad680bc6510719d3cc0e291a84d4402e6
SHA256

f68369688730d28b9033c372be78fa07d909633a3ef0587d7badc8eb3e750f1d
SHA512

bba0dc5c318bdc219ac35f9ac9f1a1d40506778b52436afaeb872c46e0e39c28294c661e897d30be7a737242c58329bd3f9715670b480baaf4bc717b2ff33fbf
SSDEEP

1536:H7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfEwcO+:b7DhdC6kzWypvaQ0FxyNTBfEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2792	a.exe
2792	a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	a.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 3064	1296	Execute Me In Lobby.exe	29
PID 1296 wrote to memory of 3064	1296	Execute Me In Lobby.exe	29
PID 1296 wrote to memory of 3064	1296	Execute Me In Lobby.exe	29
PID 1296 wrote to memory of 3064	1296	Execute Me In Lobby.exe	29
PID 3064 wrote to memory of 1740	3064	cmd.exe	30
PID 3064 wrote to memory of 1740	3064	cmd.exe	30
PID 3064 wrote to memory of 1740	3064	cmd.exe	30
PID 1740 wrote to memory of 2588	1740	net.exe	31
PID 1740 wrote to memory of 2588	1740	net.exe	31
PID 1740 wrote to memory of 2588	1740	net.exe	31
PID 3064 wrote to memory of 2348	3064	cmd.exe	32
PID 3064 wrote to memory of 2348	3064	cmd.exe	32
PID 3064 wrote to memory of 2348	3064	cmd.exe	32
PID 2348 wrote to memory of 2624	2348	net.exe	33
PID 2348 wrote to memory of 2624	2348	net.exe	33
PID 2348 wrote to memory of 2624	2348	net.exe	33
PID 3064 wrote to memory of 2792	3064	cmd.exe	34
PID 3064 wrote to memory of 2792	3064	cmd.exe	34
PID 3064 wrote to memory of 2792	3064	cmd.exe	34
PID 2792 wrote to memory of 2528	2792	a.exe	35
PID 2792 wrote to memory of 2528	2792	a.exe	35
PID 2792 wrote to memory of 2528	2792	a.exe	35

C:\Users\Admin\AppData\Local\Temp\WareHub_Cw4ck_By_discord.gg_Recte\Execute Me In Lobby.exe
"C:\Users\Admin\AppData\Local\Temp\WareHub_Cw4ck_By_discord.gg_Recte\Execute Me In Lobby.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5A21.tmp\5A22.tmp\5A23.bat "C:\Users\Admin\AppData\Local\Temp\WareHub_Cw4ck_By_discord.gg_Recte\Execute Me In Lobby.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\system32\net.exe
    NET FILE
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 FILE
      4⤵
      PID:2588
- - C:\Windows\system32\net.exe
    NET FILE
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 FILE
      4⤵
      PID:2624
- - C:\Users\Admin\AppData\Local\Temp\WareHub_Cw4ck_By_discord.gg_Recte\IGNORE-THIS-FOLDER\a.exe
    .\IGNORE-THIS-FOLDER\a.exe inject -p 1v1_LOL -a .\IGNORE-THIS-FOLDER\a.png -n LOLXUESOS -c IKSAD -m sdfmn
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2792 -s 656
      4⤵
      PID:2528

C:\Users\Admin\AppData\Local\Temp\5A21.tmp\5A22.tmp\5A23.bat

Filesize
1KB

MD5
35c6da25f9807fc18452f8127f2dd228

SHA1
63f1b757fb8344b64964339ceb0bfaf4bfcbd519

SHA256
f8afd8b32a57f63338c69685c8d97af4c3215c067bad715197a693f30617c853

SHA512
32528629c3222afe24a347c3d3d7b2cc4659c7bf2a772a6e61ec35c72452cca8f252db5c97e939acfb6291d4796822016329a6c2b93493f0733cf575ff44fed4

Download Submit
memory/2792-6-0x00000000008E0000-0x00000000008EA000-memory.dmp

Filesize
40KB

Download
memory/2792-7-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2792-8-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/2792-10-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/2792-11-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download