ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134

Analysis

Target
ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe
Size 6.9MB
Sample220701-eeykwscff7
SHA256 ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134
MD5 2575a94740dd26ae430a665940284306
SHA1 16b4e251db8edbdfea1d84841cc160f8956dd37b
SHA512 47f3649ee64ad235530371fe0aac7a4dcf0bf6cf569f2a75f6167178e45ecf3469ea43748173a547ddaec6e61de8fae4495934e370bb4c4a7950f2ded33e6132
MD5 SHA1 SHA512

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2036	4636	ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe	81
PID 4636 wrote to memory of 2036	4636	ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe	81
PID 4636 wrote to memory of 2036	4636	ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe	81

C:\Users\Admin\AppData\Local\Temp\ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe
"C:\Users\Admin\AppData\Local\Temp\ae415920001f80c468cc6cda8ba58e98f5df63f4c00f60eeefe5e686b9bc8134.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\cmd.exe
  cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
  2⤵
  - Drops startup file
  PID:2036

s.bat

Path C:\Users\Admin\AppData\Local\Temp\s.bat
Size 323B
SHA256 242ae8319f6fc55f540c71a928ca665cd23e46538b7788f67957431620827a91
MD5 3a7ad8a3c232278bfa33a022d6871681
SHA1 b8226bd6e199bf49495016c6086ffe2e0704090b
SHA512 d5892317670a05d815c47aadf6a28535c28c18ca24ab5f5f60230dea330815b4666af30ea3275fdc5688760042566815164f02d34819745271d3ace5f72d984b
MD5 SHA1 SHA512

Submit Download

memory/4636-130-0x0000000000400000-0x0000000000AE4000-memory.dmp

Download

memory/4636-133-0x0000000000400000-0x0000000000AE4000-memory.dmp

Download