5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff

Analysis

max time kernel
17s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 00:40

Target

5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe
Size

540KB
MD5

a0b20ea037ddd284d8141b7febda5e90
SHA1

4b836c6023f5aacc065c2a70907753e33b958585
SHA256

5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff
SHA512

e533503c42185b91fa0f70deb31fa81e926199f105128b0668dbfbd70ed40ac2d9ff76c1c8e31612e8d904f66dc2a2b3ac12d855be75e6c243cb01a16a22a3c3
SSDEEP

6144:s4UHFnuDk67fe2GzqOxLfPcvgKVPlw9ayr:6luDk67Sz3zKQX

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
848	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.com

Loads dropped DLL 2 IoCs

pid	Process
1284	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe
1284	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kernel.dll	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe
File created	C:\Windows\kernel.dll	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe
File created	C:\Windows\svchost.exe	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1284	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 848	1284	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe	27
PID 1284 wrote to memory of 848	1284	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe	27
PID 1284 wrote to memory of 848	1284	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe	27
PID 1284 wrote to memory of 848	1284	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe	27
PID 1284 wrote to memory of 1208	1284	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe	8

C:\Users\Admin\AppData\Local\Temp\5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.com

Filesize
452KB

MD5
b8e7696f4210d817cc56aa6191460d0c

SHA1
d671058f91f6e27b5813a803e8ff598584cfaeb4

SHA256
e8edd4e86939d8de90db42ee02ca6a587f38e6ee9f8b7db34ae5ae87e16351ee

SHA512
8ff2112d866004d19fb26244e3442ed342bae3e14a7290862e8688e372b7369d0be555b285eeb5d528359941cc54f8e27694a0f23d91e3035715f239432b5cf8

Download Submit
\Users\Admin\AppData\Local\Temp\5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.com

Filesize
452KB

MD5
b8e7696f4210d817cc56aa6191460d0c

SHA1
d671058f91f6e27b5813a803e8ff598584cfaeb4

SHA256
e8edd4e86939d8de90db42ee02ca6a587f38e6ee9f8b7db34ae5ae87e16351ee

SHA512
8ff2112d866004d19fb26244e3442ed342bae3e14a7290862e8688e372b7369d0be555b285eeb5d528359941cc54f8e27694a0f23d91e3035715f239432b5cf8

Download Submit
\Users\Admin\AppData\Local\Temp\5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.com

Filesize
452KB

MD5
b8e7696f4210d817cc56aa6191460d0c

SHA1
d671058f91f6e27b5813a803e8ff598584cfaeb4

SHA256
e8edd4e86939d8de90db42ee02ca6a587f38e6ee9f8b7db34ae5ae87e16351ee

SHA512
8ff2112d866004d19fb26244e3442ed342bae3e14a7290862e8688e372b7369d0be555b285eeb5d528359941cc54f8e27694a0f23d91e3035715f239432b5cf8

Download Submit