6d4aa425810a16dd447ef4382bf70a95683578c56ad8ee2abe60e5a13bcdadee

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 22:38

Target

6d4aa425810a16dd447ef4382bf70a95683578c56ad8ee2abe60e5a13bcdadee.exe
Size

201KB
MD5

b8ff12a993665cc870e5ceaa026fc30a
SHA1

77177e5d8465cabb7a26bd445cd5ff0bcd2b8ab7
SHA256

6d4aa425810a16dd447ef4382bf70a95683578c56ad8ee2abe60e5a13bcdadee
SHA512

79d6d4d3634e47f2eb26a5bc7d10ff0dc28e3d211eab179c55f09e3d3e234ff618e1446934d7886bc91c38f19b142ef36baadd0f5906475f63f3908abd6b8386
SSDEEP

3072:0oUvg4fqjO00Yhxumzc6QIFqC067xd8xYCm9YvQd2p:0ojV0Yvzc6QIFqCNFd8Xjp

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
424	ktyqhhb.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\ktyqhhb.exe	6d4aa425810a16dd447ef4382bf70a95683578c56ad8ee2abe60e5a13bcdadee.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5032	424	WerFault.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
424	ktyqhhb.exe
424	ktyqhhb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	424	ktyqhhb.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 3404	424	ktyqhhb.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3404
- C:\Users\Admin\AppData\Local\Temp\6d4aa425810a16dd447ef4382bf70a95683578c56ad8ee2abe60e5a13bcdadee.exe
  "C:\Users\Admin\AppData\Local\Temp\6d4aa425810a16dd447ef4382bf70a95683578c56ad8ee2abe60e5a13bcdadee.exe"
  2⤵
  - Drops file in Program Files directory
  PID:2448

C:\PROGRA~3\Mozilla\ktyqhhb.exe
C:\PROGRA~3\Mozilla\ktyqhhb.exe -arwhcpc
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 556
  2⤵
  - Program crash
  PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 424 -ip 424
1⤵
PID:1380

C:\PROGRA~3\Mozilla\ktyqhhb.exe

Filesize
201KB

MD5
fbabf33001d0e9b8e07d0ad706518886

SHA1
c233fae7e5cd18ac2d8ac57a14b3051754a71249

SHA256
10a4301a79ba9c1462fdf2ddbad0aa5067fbecc541edd6088c74145fe056913b

SHA512
3a9062e4a9a696c1281d7628ff45c2bfa5437286c70fb913f66726c16bd8c0f0bd0fdb8265384de47c3b1912fc4697aa7ec431b43b5066453e0d162823440c65

Download Submit
memory/424-7-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/424-8-0x00000000020A0000-0x00000000020FF000-memory.dmp

Filesize
380KB

Download
memory/424-10-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2448-0-0x00000000021C0000-0x000000000221F000-memory.dmp

Filesize
380KB

Download
memory/2448-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2448-5-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3404-9-0x0000000000B70000-0x0000000000B8C000-memory.dmp

Filesize
112KB

Download