46f2d84c629ed3e023478d8f264690e8ae611f5b3be12ea0f78c3cbc436e9708

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 21:32

Target

46f2d84c629ed3e023478d8f264690e8ae611f5b3be12ea0f78c3cbc436e9708.exe
Size

77KB
MD5

a00020900ea8b6344dbf074e90593a40
SHA1

e52f43127835924b49eb111b4975ed5438de60a3
SHA256

46f2d84c629ed3e023478d8f264690e8ae611f5b3be12ea0f78c3cbc436e9708
SHA512

7e2877bde4778c34d8b80f5f60c25855dd0d16369136feeeb52b3b35de29af2d5ad8042b57f3012432b48c006dc4d12a4afaa15ef32f00f63a99c8c647e32488
SSDEEP

1536:TO+AZhCZFcsifjE0SJIB/6pCypfoe6WH/Rgo:TO3ZhHsio0tBGCzoRD

Score

4^/10

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kernel.dll	46f2d84c629ed3e023478d8f264690e8ae611f5b3be12ea0f78c3cbc436e9708.exe
File created	C:\Windows\kernel.dll	46f2d84c629ed3e023478d8f264690e8ae611f5b3be12ea0f78c3cbc436e9708.exe
File created	C:\Windows\svchost.exe	46f2d84c629ed3e023478d8f264690e8ae611f5b3be12ea0f78c3cbc436e9708.exe
File opened for modification	C:\Windows\svchost.exe	46f2d84c629ed3e023478d8f264690e8ae611f5b3be12ea0f78c3cbc436e9708.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
704	46f2d84c629ed3e023478d8f264690e8ae611f5b3be12ea0f78c3cbc436e9708.exe
704	46f2d84c629ed3e023478d8f264690e8ae611f5b3be12ea0f78c3cbc436e9708.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 2648	704	46f2d84c629ed3e023478d8f264690e8ae611f5b3be12ea0f78c3cbc436e9708.exe	56