ac8df5bc262460d7e9f634c2be53ac9b028c6bf101aecc9545603e3e03c9c3a4

Resubmissions

20/05/2024, 14:17

30/04/2024, 15:26

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 15:26

Target

3ab1f51353b630da24938d4c805d67b5.exe
Size

30KB
MD5

3ab1f51353b630da24938d4c805d67b5
SHA1

9e6b132f6353a712f0284510bf8de84bb45613e5
SHA256

ac8df5bc262460d7e9f634c2be53ac9b028c6bf101aecc9545603e3e03c9c3a4
SHA512

f897a7ebffe688a8ca8b7f55012a3bbfcc78fdbc123c7f89ca396c67e30ec1f63faf60a7534fab9c7308075ecfdc1c0f363137e9f13611ec9ad92a5a4b946095
SSDEEP

768:T9qZEbWhPq3K1f0Y5feMA7QOKMsDY6Ze/0kJajZL9c7YrHG:TSJxTyieM6QOKpVgHgy7Yrm

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2832	3ab1f51353b630da24938d4c805d67b5.exe

Loads dropped DLL 1 IoCs

pid	Process
2636	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	3ab1f51353b630da24938d4c805d67b5.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2636	2936	3ab1f51353b630da24938d4c805d67b5.exe	28
PID 2936 wrote to memory of 2636	2936	3ab1f51353b630da24938d4c805d67b5.exe	28
PID 2936 wrote to memory of 2636	2936	3ab1f51353b630da24938d4c805d67b5.exe	28
PID 2636 wrote to memory of 2832	2636	cmd.exe	30
PID 2636 wrote to memory of 2832	2636	cmd.exe	30
PID 2636 wrote to memory of 2832	2636	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\3ab1f51353b630da24938d4c805d67b5.exe
"C:\Users\Admin\AppData\Local\Temp\3ab1f51353b630da24938d4c805d67b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c C:\Users\Admin\AppData\Roaming\Google\3ab1f51353b630da24938d4c805d67b5.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Roaming\Google\3ab1f51353b630da24938d4c805d67b5.exe
    C:\Users\Admin\AppData\Roaming\Google\3ab1f51353b630da24938d4c805d67b5.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2832

C:\Users\Admin\AppData\Roaming\Google\3ab1f51353b630da24938d4c805d67b5.exe

Filesize
30KB

MD5
3ab1f51353b630da24938d4c805d67b5

SHA1
9e6b132f6353a712f0284510bf8de84bb45613e5

SHA256
ac8df5bc262460d7e9f634c2be53ac9b028c6bf101aecc9545603e3e03c9c3a4

SHA512
f897a7ebffe688a8ca8b7f55012a3bbfcc78fdbc123c7f89ca396c67e30ec1f63faf60a7534fab9c7308075ecfdc1c0f363137e9f13611ec9ad92a5a4b946095

Download Submit
memory/2832-9-0x0000000000140000-0x000000000014C000-memory.dmp

Filesize
48KB

Download
memory/2832-10-0x000007FEF54B0000-0x000007FEF5E9C000-memory.dmp

Filesize
9.9MB

Download
memory/2832-12-0x000007FEF54B0000-0x000007FEF5E9C000-memory.dmp

Filesize
9.9MB

Download
memory/2832-13-0x000000001AFE0000-0x000000001B060000-memory.dmp

Filesize
512KB

Download
memory/2936-0-0x0000000000DB0000-0x0000000000DBC000-memory.dmp

Filesize
48KB

Download
memory/2936-1-0x000007FEF54B0000-0x000007FEF5E9C000-memory.dmp

Filesize
9.9MB

Download
memory/2936-2-0x0000000000140000-0x0000000000146000-memory.dmp

Filesize
24KB

Download
memory/2936-3-0x000007FEF54B0000-0x000007FEF5E9C000-memory.dmp

Filesize
9.9MB

Download
memory/2936-11-0x000007FEF54B0000-0x000007FEF5E9C000-memory.dmp

Filesize
9.9MB

Download