16b948ad8bb9df8c3c0492889cdf3da5e3dc246f36c10e2dda8c91968cad0d2c

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/09/2022, 03:45

Target

derock.exe
Size

5.3MB
MD5

b4fc61ebe6bfce1125b194e0726b07d3
SHA1

acf3c1c2dcf0e810377673e6e2caf1043f8f18a3
SHA256

16b948ad8bb9df8c3c0492889cdf3da5e3dc246f36c10e2dda8c91968cad0d2c
SHA512

0366b97eb6e7b247c041359eccd89b482e6655cbf9d282de363b8ff2b014eca91058920802152382599036c4641174cf241eb391ab7930f100adc07dc9af37a5
SSDEEP

98304:VpzPwTIwKFHW2m5lttY7X5TohKYMrAz+XE:nDwjKFHWBltez5TDYMkp

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1644	1256	derock.exe	28
PID 1256 wrote to memory of 1644	1256	derock.exe	28
PID 1256 wrote to memory of 1644	1256	derock.exe	28

C:\Users\Admin\AppData\Local\Temp\derock.exe
"C:\Users\Admin\AppData\Local\Temp\derock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\system32\notepad.exe
  notepad C:\Users\Admin\AppData\Local\Temp\DesktopHealthCheck-Output\health-check-report_20220930_054550UTC.json
  2⤵
  PID:1644

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\DesktopHealthCheck-Output\health-check-report_20220930_054550UTC.json

Filesize
1KB

MD5
a48c9c40d8fa7ca981fa7a8ef0d0b45e

SHA1
51ab340c283c67f343dfde18c64f95e3204585a3

SHA256
9c7c2aff00285235d377c1eb993b73755c0628ce1b8bdd70b73b5ac5cecdacd9

SHA512
5ac998c2392ce94f53a3b36bc1750509c74d25701c0d2a402b60028b9f1950eb13458a128c157382db71c88da4b662f2c75b9440756be8dc7b981b829981b0c5

Download Submit
memory/1644-55-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Filesize
8KB

Download