5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff

Analysis

max time kernel
166s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 00:40

Target

5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe
Size

540KB
MD5

a0b20ea037ddd284d8141b7febda5e90
SHA1

4b836c6023f5aacc065c2a70907753e33b958585
SHA256

5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff
SHA512

e533503c42185b91fa0f70deb31fa81e926199f105128b0668dbfbd70ed40ac2d9ff76c1c8e31612e8d904f66dc2a2b3ac12d855be75e6c243cb01a16a22a3c3
SSDEEP

6144:s4UHFnuDk67fe2GzqOxLfPcvgKVPlw9ayr:6luDk67Sz3zKQX

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2604	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\kernel.dll	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe
File created	C:\Windows\svchost.exe	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe
File opened for modification	C:\Windows\kernel.dll	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2556	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe
2556	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2604	2556	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe	82
PID 2556 wrote to memory of 2604	2556	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe	82
PID 2556 wrote to memory of 2604	2556	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe	82
PID 2556 wrote to memory of 684	2556	5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.exe	36

C:\Users\Admin\AppData\Local\Temp\5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.com

Filesize
452KB

MD5
b8e7696f4210d817cc56aa6191460d0c

SHA1
d671058f91f6e27b5813a803e8ff598584cfaeb4

SHA256
e8edd4e86939d8de90db42ee02ca6a587f38e6ee9f8b7db34ae5ae87e16351ee

SHA512
8ff2112d866004d19fb26244e3442ed342bae3e14a7290862e8688e372b7369d0be555b285eeb5d528359941cc54f8e27694a0f23d91e3035715f239432b5cf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a6846ebb358cb54482e57c7aa2726faa9ba0da69356532c0c54d72a5cc93bff.com

Filesize
452KB

MD5
b8e7696f4210d817cc56aa6191460d0c

SHA1
d671058f91f6e27b5813a803e8ff598584cfaeb4

SHA256
e8edd4e86939d8de90db42ee02ca6a587f38e6ee9f8b7db34ae5ae87e16351ee

SHA512
8ff2112d866004d19fb26244e3442ed342bae3e14a7290862e8688e372b7369d0be555b285eeb5d528359941cc54f8e27694a0f23d91e3035715f239432b5cf8

Download Submit