ead4c64dcb0ff4e4d34cbeb97666b7f17aa8afa0482f6c87bfa50eec97847977

Analysis

max time kernel
146s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 15:48

Target

3a4f070cfd4773e44c750c4e7b609441.exe
Size

65KB
MD5

3a4f070cfd4773e44c750c4e7b609441
SHA1

9d40b9a234480f2f5bbb5efc2cfdd49a08b3870c
SHA256

ead4c64dcb0ff4e4d34cbeb97666b7f17aa8afa0482f6c87bfa50eec97847977
SHA512

320b04e4fa4d92a23356d2cb03c7a13c6baad5ff3f7e1aa75c2376ae4b647b773dfd08bcad396d5d6f50dd59ebbaad6bdb10bbf270d28cd12ff061a383952e23
SSDEEP

768:1fR895vQgDYJa2Vz16ipD/Kf/W5jRxv8m5zpD/fd3jEFaq0WOH0uO3jPpxwb+kjY:1fR8PvYs+zXp171QFL8H05LrMd7fojd

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
920	kyuuyg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kyuuyg.exe	3a4f070cfd4773e44c750c4e7b609441.exe
File opened for modification	C:\Windows\SysWOW64\kyuuyg.exe	3a4f070cfd4773e44c750c4e7b609441.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1716	3a4f070cfd4773e44c750c4e7b609441.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 4640	1716	3a4f070cfd4773e44c750c4e7b609441.exe	18
PID 1716 wrote to memory of 4640	1716	3a4f070cfd4773e44c750c4e7b609441.exe	18
PID 1716 wrote to memory of 4640	1716	3a4f070cfd4773e44c750c4e7b609441.exe	18

C:\Users\Admin\AppData\Local\Temp\3a4f070cfd4773e44c750c4e7b609441.exe
"C:\Users\Admin\AppData\Local\Temp\3a4f070cfd4773e44c750c4e7b609441.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\3A4F07~1.EXE > nul
  2⤵
  PID:4640

C:\Windows\SysWOW64\kyuuyg.exe
C:\Windows\SysWOW64\kyuuyg.exe
1⤵
- Executes dropped EXE
PID:920

C:\Windows\SysWOW64\kyuuyg.exe

Filesize
11KB

MD5
de3cff2d90b1836a4c45b94de8beb6c2

SHA1
25c30caea3db2e8e33e0ce21b01907ea33c7485d

SHA256
877326bfdaef2f346a8471c09a8aaaf706d0b430e900382aca66fd83656031df

SHA512
969303dc75a0a1ad776540861ac288634847e2b91d1d455e70937d0f3b757ce4089e5bba4277a2e7def83bc8854a73946fef39c6fbec0aa9d5cb1cb4f870facb

Download Submit
C:\Windows\SysWOW64\kyuuyg.exe

Filesize
4KB

MD5
5be0145a2bd0d2abae523c036e7e832e

SHA1
c22dbe1d0ad7904a6d531cad834b316ef764937e

SHA256
43666cae77caf784e616d6d44de55dc8649f3a1daa467fc9e5bdf9b8c67dd106

SHA512
dd1978d2f0413072292595ec2c7287465b056d5d948139a9bb301858ed669e6d165059a443cf70270507194bb20f257e055b7ce4a5244f472a7c55a2e5ce687d

Download Submit