79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a

Analysis

max time kernel
47s
max time network
87s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 23:29

Target

79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.exe
Size

182KB
MD5

06c95613dec0207807205c247a24db15
SHA1

88ff30134dda727b3a69cc3340e24cb2371d96b4
SHA256

79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a
SHA512

bf83cbd87a4d484ede5e7e3d46b8f9b09394ece182190f85f0fa5d89382f19052961582888acd4c3a01153620eaae4b4f48eb030b4442aac675cd3d94502ce14
SSDEEP

3072:sdmtrAHFRpxvMDk67fXf4b2IRL6PAf+Q8wJno2lKiXNbBR1:s4UHFnuDk67fe2Hlw9ay

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1344	79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.com

Loads dropped DLL 2 IoCs

pid	Process
1204	79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.exe
1204	79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kernel.dll	79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.exe
File created	C:\Windows\kernel.dll	79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.exe
File created	C:\Windows\svchost.exe	79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1204	79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.exe	27
PID 1204 wrote to memory of 1344	1204	79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.exe	27
PID 1204 wrote to memory of 1344	1204	79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.exe	27
PID 1204 wrote to memory of 1344	1204	79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.exe	27
PID 1204 wrote to memory of 1288	1204	79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.exe	8

C:\Users\Admin\AppData\Local\Temp\79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.com

Filesize
94KB

MD5
c13648a6fa8d2dc480a7c133ddb64fde

SHA1
a298e13a4a120cd8df4ed6a737bdfeb1d8620bc6

SHA256
b791b2325e73ffda572be52a350a841d62e6330a03d1fd20f0950049ff332cec

SHA512
8a6c5b975fa1208700086033091ef3ac35a2e94ea9bb1962a08e026d196039e8bd022526588833f246d1ea0302da83fdb840487f881ccff02b08160b02804a1f

Download Submit
\Users\Admin\AppData\Local\Temp\79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.com

Filesize
94KB

MD5
c13648a6fa8d2dc480a7c133ddb64fde

SHA1
a298e13a4a120cd8df4ed6a737bdfeb1d8620bc6

SHA256
b791b2325e73ffda572be52a350a841d62e6330a03d1fd20f0950049ff332cec

SHA512
8a6c5b975fa1208700086033091ef3ac35a2e94ea9bb1962a08e026d196039e8bd022526588833f246d1ea0302da83fdb840487f881ccff02b08160b02804a1f

Download Submit
\Users\Admin\AppData\Local\Temp\79868f62b6084ffabd85b9aa9dd9581a870fb8032d8972531638b9ff1a796b1a.com

Filesize
94KB

MD5
c13648a6fa8d2dc480a7c133ddb64fde

SHA1
a298e13a4a120cd8df4ed6a737bdfeb1d8620bc6

SHA256
b791b2325e73ffda572be52a350a841d62e6330a03d1fd20f0950049ff332cec

SHA512
8a6c5b975fa1208700086033091ef3ac35a2e94ea9bb1962a08e026d196039e8bd022526588833f246d1ea0302da83fdb840487f881ccff02b08160b02804a1f

Download Submit