605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650

Analysis

max time kernel
61s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-10-2022 05:49

Target

605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650.exe
Size

13KB
MD5

3c05ed63ccff49fae7aa3ce3cc045dc4
SHA1

de30bf861610dd007bf6969ece016327206a2c8e
SHA256

605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650
SHA512

deb805274ba24d54ecf587faa1ddd4944a35ed601358b4047360a5aa51079cc38c20cf71abee52f0a89535cf4a71d52831a29d1cfcfaf23ce86e2c16e4b81b4d
SSDEEP

192:6kWjQTlZ1eB+pvdNtj2+SPwHP+Q/ZCv2qwvuCKK76n9bJHOkrUNi:6kjTlZ02NtvSKP+cZC+qwZPGn9bJrUN

Score

4^/10

Drops file in Windows directory 2 IoCs

Processes:

605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650.exe
File opened for modification	C:\Windows\Tasks\wow64.job	605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2004 wrote to memory of 944	2004	taskeng.exe	605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650.exe
PID 2004 wrote to memory of 944	2004	taskeng.exe	605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650.exe
PID 2004 wrote to memory of 944	2004	taskeng.exe	605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650.exe
PID 2004 wrote to memory of 944	2004	taskeng.exe	605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650.exe

C:\Users\Admin\AppData\Local\Temp\605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650.exe
"C:\Users\Admin\AppData\Local\Temp\605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650.exe"
1⤵
- Drops file in Windows directory
PID:1764

C:\Windows\system32\taskeng.exe
taskeng.exe {964A8BDE-0DCA-41B4-BC7A-5FBD27C3FA30} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Users\Admin\AppData\Local\Temp\605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650.exe
C:\Users\Admin\AppData\Local\Temp\605fa356dc438ac90419f85f0e903bd64f34125b6c52aeac3e58dd0056122650.exe start
2⤵
PID:944

memory/944-55-0x0000000000000000-mapping.dmp

Download
memory/1764-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download