ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134

Analysis

Target

ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe
Size

6.9MB
MD5

2575a94740dd26ae430a665940284306
SHA1

16b4e251db8edbdfea1d84841cc160f8956dd37b
SHA256

ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134
SHA512

47f3649ee64ad235530371fe0aac7a4dcf0bf6cf569f2a75f6167178e45ecf3469ea43748173a547ddaec6e61de8fae4495934e370bb4c4a7950f2ded33e6132

Score

7^/10

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe

description	pid	process	target process
PID 560 wrote to memory of 892	560	ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe	cmd.exe
PID 560 wrote to memory of 892	560	ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe	cmd.exe
PID 560 wrote to memory of 892	560	ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe	cmd.exe
PID 560 wrote to memory of 892	560	ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe
"C:\Users\Admin\AppData\Local\Temp\ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\SysWOW64\cmd.exe
cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
2⤵
- Drops startup file
PID:892

C:\Users\Admin\AppData\Local\Temp\s.bat
Filesize
323B

MD5
3a7ad8a3c232278bfa33a022d6871681

SHA1
b8226bd6e199bf49495016c6086ffe2e0704090b

SHA256
242ae8319f6fc55f540c71a928ca665cd23e46538b7788f67957431620827a91

SHA512
d5892317670a05d815c47aadf6a28535c28c18ca24ab5f5f60230dea330815b4666af30ea3275fdc5688760042566815164f02d34819745271d3ace5f72d984b

Download Submit
memory/560-54-0x0000000075271000-0x0000000075273000-memory.dmp

Filesize
8KB

Download
memory/560-57-0x0000000000400000-0x0000000000AE4000-memory.dmp

Filesize
6.9MB

Download
memory/560-58-0x0000000000400000-0x0000000000AE4000-memory.dmp

Filesize
6.9MB

Download
memory/892-55-0x0000000000000000-mapping.dmp

Download