bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79

Analysis

max time kernel
45s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 20:51

Target

bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe
Size

87KB
MD5

5ea673457b1df7394c4e4736898a01f2
SHA1

b050fa9d4bd17922136d54bfbdf703505c69ed40
SHA256

bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79
SHA512

4a15bf85701ea4c504d83f14c5e61e01b0aa2ebace21142c852188dc04cbe44401fbb6e582a2ac8699396c5fab03349e032fd00b1908d5863ce4d1ea63c437ce
SSDEEP

1536:Ky2u+njSfu/wkyA+JLsfVOydQqXPtzCn86AtKIvBSj9pwwvO1BIrD5FebDdQ:Kv5jSJA+pstOy/VKNlkB+9zrD5FWDdQ

Score

4^/10

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\plugin1.dat	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe
File opened for modification	C:\Windows\svchost.exe	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe
File created	C:\Windows\svchost.exe	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe
1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1256	1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe	10
PID 1828 wrote to memory of 1256	1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe	10
PID 1828 wrote to memory of 2044	1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe	27
PID 1828 wrote to memory of 2044	1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe	27
PID 1828 wrote to memory of 2044	1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe	27
PID 1828 wrote to memory of 2044	1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe	27
PID 1828 wrote to memory of 2044	1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe	27
PID 1828 wrote to memory of 2044	1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe	27
PID 1828 wrote to memory of 2044	1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe	27
PID 1828 wrote to memory of 2044	1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe	27
PID 1828 wrote to memory of 1256	1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe	10
PID 1828 wrote to memory of 1256	1828	bb15041b1953f9e37c025ef14c286280cff7cb1a7095382f05c6019020913c79.exe	10

memory/1828-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1828-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download