bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 00:38

Target

bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.exe
Size

502KB
MD5

a0de1444d1059879bb4d16827bf46890
SHA1

54adb0a21031f0e17dda5c9a4304b2901afd288e
SHA256

bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a
SHA512

9e41601138f07044023f8037a71192cbe785c501cefeeae6a6ef3d0cf968978c07bd3f8337b91b0ec42aea0ded8745f6d49bc6998de67531a886aece718dbc42
SSDEEP

6144:s4UHFnuDk67fe2olw9ayUqOxLfPcvgKVp:6luDk67HI3zKH

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
5024	bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kernel.dll	bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.exe
File created	C:\Windows\kernel.dll	bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.exe
File created	C:\Windows\svchost.exe	bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3368	bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.exe
3368	bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 5024	3368	bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.exe	80
PID 3368 wrote to memory of 5024	3368	bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.exe	80
PID 3368 wrote to memory of 5024	3368	bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.exe	80
PID 3368 wrote to memory of 2556	3368	bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.exe	38

C:\Users\Admin\AppData\Local\Temp\bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.com

Filesize
414KB

MD5
4fdc790ac6818e780d782ac1242defd1

SHA1
5f5ea173ead49cd3d1e1850345f6bf9064928c13

SHA256
1eb236c305aea4fc932c86b6855e812c23eda4527185920aa59cfe709cf70756

SHA512
a9f9a5b8fc70daa7f0a6c74e9828ed7734b2aebab1d6fbb8f49603af67000f988ca2a1c04b3926e425aa4299c22fd778da3f246c8745112aa7236f49e78aff70

Download Submit
C:\Users\Admin\AppData\Local\Temp\bf270db6f70efacca2e66e65a90d8f544edc843a86db692ab4963e98c1ab844a.com

Filesize
414KB

MD5
4fdc790ac6818e780d782ac1242defd1

SHA1
5f5ea173ead49cd3d1e1850345f6bf9064928c13

SHA256
1eb236c305aea4fc932c86b6855e812c23eda4527185920aa59cfe709cf70756

SHA512
a9f9a5b8fc70daa7f0a6c74e9828ed7734b2aebab1d6fbb8f49603af67000f988ca2a1c04b3926e425aa4299c22fd778da3f246c8745112aa7236f49e78aff70

Download Submit