d119b97d94bab60f08e94ac3c282f12fca3963ea55143f2de8ab0517f168baba

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 23:53

Target

d119b97d94bab60f08e94ac3c282f12fca3963ea55143f2de8ab0517f168baba.exe
Size

107KB
MD5

af45315241dbf2a350e97d0ea9c23e3e
SHA1

b2ab6ea969603092ea3d1f3af4ebb4facc66e878
SHA256

d119b97d94bab60f08e94ac3c282f12fca3963ea55143f2de8ab0517f168baba
SHA512

dc7cb9d46f8ada8f5832ba8914253860ebeab2d6e67aa7b9391d88af341004fe5f35bf0a5923aa6e41a7b6f2ea868b0322c37420d6b9484a2ba0ef8550d1bcad
SSDEEP

3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJtu:mh7c5dFK70K7No

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4216	qhdqeom.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\qhdqeom.exe	d119b97d94bab60f08e94ac3c282f12fca3963ea55143f2de8ab0517f168baba.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	4216	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4216	qhdqeom.exe
4216	qhdqeom.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	qhdqeom.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 3588	4216	qhdqeom.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3588
- C:\Users\Admin\AppData\Local\Temp\d119b97d94bab60f08e94ac3c282f12fca3963ea55143f2de8ab0517f168baba.exe
  "C:\Users\Admin\AppData\Local\Temp\d119b97d94bab60f08e94ac3c282f12fca3963ea55143f2de8ab0517f168baba.exe"
  2⤵
  - Drops file in Program Files directory
  PID:4852

C:\PROGRA~3\Mozilla\qhdqeom.exe
C:\PROGRA~3\Mozilla\qhdqeom.exe -tgbfvga
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 504
  2⤵
  - Program crash
  PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4216 -ip 4216
1⤵
PID:3272

C:\PROGRA~3\Mozilla\qhdqeom.exe

Filesize
108KB

MD5
0cf1259a6bb13f31f904f1b092e19e65

SHA1
797ff3390257b448cfa50fcd284f6f79bd243ac2

SHA256
75716571fbd0ef35fa204e41a8cc1615e83ace78b5667543fdc9a9f30e53b3fb

SHA512
429d91ce686a07db0f2bfde2154a3faad45b3cafb16510de3a87887672556f41e02f782f04524c1138cd76fd14f3e5231e2d3da2518210b60264c10816384cde

Download Submit
memory/3588-3-0x0000000002B60000-0x0000000002B7C000-memory.dmp

Filesize
112KB

Download