70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d

Analysis

max time kernel
39s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 00:40

Target

70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.exe
Size

994KB
MD5

a24f0c2733145d5c7c63b033357680c0
SHA1

60e41ac00752816cf7124ea44ab02508dea20fab
SHA256

70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d
SHA512

660c45f98e9556825affe097c06c61dc432df7a52cf88329391b8925cf0c8195d99b87dca047c351232707952c1d66fbe70d0b7ec9bf13146b0851fc86621bbb
SSDEEP

12288:6luDk67Sz3zKQeW1zRRaMMMMM2MMMMMF3zKH:Lk6BK1zRRaMMMMM2MMMMMQH

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1856	70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.com

Loads dropped DLL 2 IoCs

pid	Process
1476	70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.exe
1476	70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kernel.dll	70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.exe
File created	C:\Windows\kernel.dll	70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.exe
File created	C:\Windows\svchost.exe	70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1476	70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1856	1476	70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.exe	27
PID 1476 wrote to memory of 1856	1476	70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.exe	27
PID 1476 wrote to memory of 1856	1476	70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.exe	27
PID 1476 wrote to memory of 1856	1476	70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.exe	27
PID 1476 wrote to memory of 1340	1476	70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.exe	11

C:\Users\Admin\AppData\Local\Temp\70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.com

Filesize
906KB

MD5
29eb98588ee06b16c57066844140b753

SHA1
353c2408834002c756eea874168adc74433b6c47

SHA256
768e25a68a8dd2f7ca89c8470250a324b13885268d1f9253fa8175ca4c789124

SHA512
d1a766221181ca7b4ce248e0de2276d2f2f05f4ed2b3d557f65bb6c606ec2dd8dbbc84404ad1904568a129f7313fe6bc2e989a9f7ff9c36b0e96307378a96b43

Download Submit
\Users\Admin\AppData\Local\Temp\70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.com

Filesize
906KB

MD5
29eb98588ee06b16c57066844140b753

SHA1
353c2408834002c756eea874168adc74433b6c47

SHA256
768e25a68a8dd2f7ca89c8470250a324b13885268d1f9253fa8175ca4c789124

SHA512
d1a766221181ca7b4ce248e0de2276d2f2f05f4ed2b3d557f65bb6c606ec2dd8dbbc84404ad1904568a129f7313fe6bc2e989a9f7ff9c36b0e96307378a96b43

Download Submit
\Users\Admin\AppData\Local\Temp\70977969b9b9cbfd9e987aaee05c87f00fa72a751c35128dc4a915214a04447d.com

Filesize
906KB

MD5
29eb98588ee06b16c57066844140b753

SHA1
353c2408834002c756eea874168adc74433b6c47

SHA256
768e25a68a8dd2f7ca89c8470250a324b13885268d1f9253fa8175ca4c789124

SHA512
d1a766221181ca7b4ce248e0de2276d2f2f05f4ed2b3d557f65bb6c606ec2dd8dbbc84404ad1904568a129f7313fe6bc2e989a9f7ff9c36b0e96307378a96b43

Download Submit