2cd97cb3d466e84fb5c77c556c74e5235014e909c7ad5e6477b22c4c855dae25

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 20:23

Target

2cd97cb3d466e84fb5c77c556c74e5235014e909c7ad5e6477b22c4c855dae25.exe
Size

173KB
MD5

28a29eb3ba8879d946e7ad0895028f6a
SHA1

7871fe5dd6d8c663c8bd73c52d40bad1f63fdb22
SHA256

2cd97cb3d466e84fb5c77c556c74e5235014e909c7ad5e6477b22c4c855dae25
SHA512

1102c0dae4f04991f4766d7bcd905d8f6b1e34a2544558df2a286397162e3d6bba6a63ae4ea5f67e9cda399c9235bd2f876c480e925a6cec9fa84368274f1ab6
SSDEEP

3072:zoUvg4fqjO00Yhxuizc6QIFqC067xd8xYFa15e:zojV0Y3zc6QIFqCNFd81q

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2280	cwtsudd.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\cwtsudd.exe	2cd97cb3d466e84fb5c77c556c74e5235014e909c7ad5e6477b22c4c855dae25.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	cwtsudd.exe
Token: SeDebugPrivilege	1244	Explorer.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2124	2cd97cb3d466e84fb5c77c556c74e5235014e909c7ad5e6477b22c4c855dae25.exe
2280	cwtsudd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2280	1984	taskeng.exe	29
PID 1984 wrote to memory of 2280	1984	taskeng.exe	29
PID 1984 wrote to memory of 2280	1984	taskeng.exe	29
PID 1984 wrote to memory of 2280	1984	taskeng.exe	29
PID 2280 wrote to memory of 1244	2280	cwtsudd.exe	21

C:\Windows\system32\taskeng.exe
taskeng.exe {BA1142BF-1AA1-4BF3-8BFB-31D07AE28C12} S-1-5-21-2610426812-2871295383-373749122-1000:UEITMFAB\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\PROGRA~3\Mozilla\cwtsudd.exe
  C:\PROGRA~3\Mozilla\cwtsudd.exe -ldxtpdk
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2280

C:\PROGRA~3\Mozilla\cwtsudd.exe

Filesize
173KB

MD5
e723bcdfddf71509ca31bc14ca22e860

SHA1
002ab990e0aa369212a51182a63cf98c6cecc159

SHA256
5b16f3391dd304aac6687c0054d5c6cd5e15ab92e764f3bcc4d7df973900a1b1

SHA512
6e5ee335b853f894e7319f9b00a57edede504da060b77a2649d7a181df8d1df4f3369796ad84ea0bf5263104297810afc8550d03dc4b28f6bd249534a82a3a6f

Download Submit
memory/1244-8-0x0000000002970000-0x000000000298C000-memory.dmp

Filesize
112KB

Download
memory/1244-10-0x0000000002970000-0x000000000298C000-memory.dmp

Filesize
112KB

Download
memory/2124-0-0x0000000000540000-0x000000000059F000-memory.dmp

Filesize
380KB

Download
memory/2124-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2124-3-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2280-6-0x0000000000240000-0x000000000029F000-memory.dmp

Filesize
380KB

Download
memory/2280-7-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2280-12-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download