d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f

Analysis

max time kernel
179s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 21:55

Target

d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f.exe
Size

29KB
MD5

0450a6c65908290d66a9f050b9eac80c
SHA1

be2f9e4bf4ede8806bcd27373fbe7f837023ad4b
SHA256

d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f
SHA512

8c2bf5ad21e2602a01802a3ecd88ca1897b505832dd18998f48958a175d81a08efa5c821722dd7c65cf92836c58f453b4f567439c50565eb776f3f227ebc7384
SSDEEP

768:kqzUBKzyXmJnHyAtKzCIztwLZ/5bu7O5T:RUBIyCnHgz3BSn5T

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1960	NTdHcP.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NTdHcP.exe	d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f.exe
File opened for modification	C:\Windows\SysWOW64\NTdHcP.exe	d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f.exe
File opened for modification	C:\Windows\SysWOW64\NTdHcP.exe	NTdHcP.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Deleteme.bat	d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1960	4916	d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f.exe	78
PID 4916 wrote to memory of 1960	4916	d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f.exe	78
PID 4916 wrote to memory of 1960	4916	d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f.exe	78
PID 4916 wrote to memory of 1252	4916	d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f.exe	79
PID 4916 wrote to memory of 1252	4916	d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f.exe	79
PID 4916 wrote to memory of 1252	4916	d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f.exe	79

C:\Users\Admin\AppData\Local\Temp\d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f.exe
"C:\Users\Admin\AppData\Local\Temp\d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\NTdHcP.exe
  C:\Windows\system32\NTdHcP.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Deleteme.bat
  2⤵
  PID:1252

C:\Windows\Deleteme.bat

Filesize
248B

MD5
5937acf51ce7a138ac165632a2cb9446

SHA1
98a703087b718d53b9fa80ac9e2a736ea9fea55d

SHA256
c7dd3cc7d0cae9ec859391f2d9e85e5c3ce35f3a9c098a8eee0486011d055e6a

SHA512
f8d0ddb6ac3d1926f379727de5057de997092b93910262d937988ec52b52adbf957a3cb6eed293bb265ffd4aa2e10f5975580f8f67709c9ae55a67d2e5f1e09a

Download Submit
C:\Windows\SysWOW64\NTdHcP.exe

Filesize
29KB

MD5
0450a6c65908290d66a9f050b9eac80c

SHA1
be2f9e4bf4ede8806bcd27373fbe7f837023ad4b

SHA256
d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f

SHA512
8c2bf5ad21e2602a01802a3ecd88ca1897b505832dd18998f48958a175d81a08efa5c821722dd7c65cf92836c58f453b4f567439c50565eb776f3f227ebc7384

Download Submit
C:\Windows\SysWOW64\NTdHcP.exe

Filesize
29KB

MD5
0450a6c65908290d66a9f050b9eac80c

SHA1
be2f9e4bf4ede8806bcd27373fbe7f837023ad4b

SHA256
d460e773b6e7723270eccb98fdf723ac884380bdb3bc52c8e132efeea3f1524f

SHA512
8c2bf5ad21e2602a01802a3ecd88ca1897b505832dd18998f48958a175d81a08efa5c821722dd7c65cf92836c58f453b4f567439c50565eb776f3f227ebc7384

Download Submit
memory/1960-137-0x0000000000400000-0x000000000041D200-memory.dmp

Filesize
116KB

Download
memory/1960-138-0x0000000000400000-0x000000000041D200-memory.dmp

Filesize
116KB

Download
memory/4916-133-0x0000000000400000-0x000000000041D200-memory.dmp

Filesize
116KB

Download
memory/4916-140-0x0000000000400000-0x000000000041D200-memory.dmp

Filesize
116KB

Download