ac8df5bc262460d7e9f634c2be53ac9b028c6bf101aecc9545603e3e03c9c3a4

Resubmissions

20/05/2024, 14:17

30/04/2024, 15:26

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 15:26

Target

3ab1f51353b630da24938d4c805d67b5.exe
Size

30KB
MD5

3ab1f51353b630da24938d4c805d67b5
SHA1

9e6b132f6353a712f0284510bf8de84bb45613e5
SHA256

ac8df5bc262460d7e9f634c2be53ac9b028c6bf101aecc9545603e3e03c9c3a4
SHA512

f897a7ebffe688a8ca8b7f55012a3bbfcc78fdbc123c7f89ca396c67e30ec1f63faf60a7534fab9c7308075ecfdc1c0f363137e9f13611ec9ad92a5a4b946095
SSDEEP

768:T9qZEbWhPq3K1f0Y5feMA7QOKMsDY6Ze/0kJajZL9c7YrHG:TSJxTyieM6QOKpVgHgy7Yrm

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4380	3ab1f51353b630da24938d4c805d67b5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	3ab1f51353b630da24938d4c805d67b5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4764	1936	3ab1f51353b630da24938d4c805d67b5.exe	88
PID 1936 wrote to memory of 4764	1936	3ab1f51353b630da24938d4c805d67b5.exe	88
PID 4764 wrote to memory of 4380	4764	cmd.exe	90
PID 4764 wrote to memory of 4380	4764	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\3ab1f51353b630da24938d4c805d67b5.exe
"C:\Users\Admin\AppData\Local\Temp\3ab1f51353b630da24938d4c805d67b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c C:\Users\Admin\AppData\Roaming\Google\3ab1f51353b630da24938d4c805d67b5.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Users\Admin\AppData\Roaming\Google\3ab1f51353b630da24938d4c805d67b5.exe
    C:\Users\Admin\AppData\Roaming\Google\3ab1f51353b630da24938d4c805d67b5.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4380

C:\Users\Admin\AppData\Roaming\Google\3ab1f51353b630da24938d4c805d67b5.exe

Filesize
30KB

MD5
3ab1f51353b630da24938d4c805d67b5

SHA1
9e6b132f6353a712f0284510bf8de84bb45613e5

SHA256
ac8df5bc262460d7e9f634c2be53ac9b028c6bf101aecc9545603e3e03c9c3a4

SHA512
f897a7ebffe688a8ca8b7f55012a3bbfcc78fdbc123c7f89ca396c67e30ec1f63faf60a7534fab9c7308075ecfdc1c0f363137e9f13611ec9ad92a5a4b946095

Download Submit
memory/1936-0-0x0000024F30CC0000-0x0000024F30CCC000-memory.dmp

Filesize
48KB

Download
memory/1936-1-0x00007FFFE3420000-0x00007FFFE3EE1000-memory.dmp

Filesize
10.8MB

Download
memory/1936-2-0x0000024F32820000-0x0000024F32826000-memory.dmp

Filesize
24KB

Download
memory/1936-3-0x00007FFFE3420000-0x00007FFFE3EE1000-memory.dmp

Filesize
10.8MB

Download
memory/1936-10-0x00007FFFE3420000-0x00007FFFE3EE1000-memory.dmp

Filesize
10.8MB

Download
memory/4380-8-0x00007FFFE3420000-0x00007FFFE3EE1000-memory.dmp

Filesize
10.8MB

Download
memory/4380-11-0x00007FFFE3420000-0x00007FFFE3EE1000-memory.dmp

Filesize
10.8MB

Download
memory/4380-12-0x0000022C5FCA0000-0x0000022C5FCB0000-memory.dmp

Filesize
64KB

Download