52a6bede9118bda5d1699b5f3f6f80b22808691419dd5070975621529b28de40

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
17-11-2023 18:57

Target

WareHub_Cw4ck_By_discord.gg_Recte/IGNORE-THIS-FOLDER/a
Size

137KB
MD5

ba8dd704aec13e3b16cfd650592556d5
SHA1

2a629e2d367b0586ba25a60cc645024028350d76
SHA256

aab6e7dfe3fa196e2e86556ae1e590b2164f8eae897fc2c9a3fe8b75991cb6be
SHA512

1de5ccff68494dc30d9fbcc49d23f414f0a814217ba69385611530d410e55bb8bf36f714d15af968b7243de7e62d19240b9befd2e75612845ecf9446b80c77ac
SSDEEP

3072:Ov9iup2AUCGJdL8soYOtGw8XEnJJX45bOS/SdAJt9vBhTWOHdwxZAqJE/:2ECUDUd455/Skt9ZxN8ZAd

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2264	a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2264	2916	cmd.exe	29
PID 2916 wrote to memory of 2264	2916	cmd.exe	29
PID 2916 wrote to memory of 2264	2916	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\WareHub_Cw4ck_By_discord.gg_Recte\IGNORE-THIS-FOLDER\a
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\WareHub_Cw4ck_By_discord.gg_Recte\IGNORE-THIS-FOLDER\a.exe
  C:\Users\Admin\AppData\Local\Temp\WareHub_Cw4ck_By_discord.gg_Recte\IGNORE-THIS-FOLDER\a
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264

memory/2264-0-0x0000000000D70000-0x0000000000D7A000-memory.dmp

Filesize
40KB

Download
memory/2264-1-0x0000000000350000-0x000000000035C000-memory.dmp

Filesize
48KB

Download
memory/2264-2-0x000007FEF5CA0000-0x000007FEF668C000-memory.dmp

Filesize
9.9MB

Download
memory/2264-4-0x000007FEF5CA0000-0x000007FEF668C000-memory.dmp

Filesize
9.9MB

Download