effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 07:55

Target

effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe
Size

10KB
MD5

fbee3e39b2b39fa60a8be3f13d1f98a3
SHA1

1bf40c0c919ae15957ce7b49841317ac9e41a497
SHA256

effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae
SHA512

9fe80bd109d58a515e1d155bf11b8d84431f65f24724b6bcbf30123ab920b60be78c5d8948985590d484f5c53c7895e313eaa55c2b9e95ce639eb6a54dc187c6
SSDEEP

192:uPzu2qjomwqFWQS4NajcQXzTeb0+vlOpWAZ79z5D1Q54Iz05LS/eNu:8K2qjoqF8U+eA+9GWAZRYaI41S/eNu

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4016	system.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\jiu.txt	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe
File created	C:\Windows\SysWOW64\system.exe	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe
File opened for modification	C:\Windows\SysWOW64\system.exe	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 4016	2232	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	80
PID 2232 wrote to memory of 4016	2232	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	80
PID 2232 wrote to memory of 4016	2232	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	80
PID 2232 wrote to memory of 1796	2232	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	81
PID 2232 wrote to memory of 1796	2232	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	81
PID 2232 wrote to memory of 1796	2232	effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe	81

C:\Users\Admin\AppData\Local\Temp\effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe
"C:\Users\Admin\AppData\Local\Temp\effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\system.exe
  C:\Windows\system32\system.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /q /a "C:\Users\Admin\AppData\Local\Temp\effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae.exe"
  2⤵
  PID:1796

C:\Windows\SysWOW64\system.exe

Filesize
10KB

MD5
fbee3e39b2b39fa60a8be3f13d1f98a3

SHA1
1bf40c0c919ae15957ce7b49841317ac9e41a497

SHA256
effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae

SHA512
9fe80bd109d58a515e1d155bf11b8d84431f65f24724b6bcbf30123ab920b60be78c5d8948985590d484f5c53c7895e313eaa55c2b9e95ce639eb6a54dc187c6

Download Submit
C:\Windows\SysWOW64\system.exe

Filesize
10KB

MD5
fbee3e39b2b39fa60a8be3f13d1f98a3

SHA1
1bf40c0c919ae15957ce7b49841317ac9e41a497

SHA256
effefbd4b6c2c90ca40017ec15000fb32f68d7fa1c1d30df69b8cd906b6e51ae

SHA512
9fe80bd109d58a515e1d155bf11b8d84431f65f24724b6bcbf30123ab920b60be78c5d8948985590d484f5c53c7895e313eaa55c2b9e95ce639eb6a54dc187c6

Download Submit
memory/2232-136-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4016-137-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download