51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8

Analysis

max time kernel
534s
max time network
601s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2022 00:07

Target

51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked_dropper.exe
Size

424KB
MD5

15678528c7da011fbfd152f46883bf26
SHA1

f1d1a0bb8e3d4242203b954723948a89ca21434a
SHA256

51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8
SHA512

3e2d3c4f9ec19585ddb552156ed1514cfa186fd77507e69ae8c8e95d13fe0633ba5f81553499fcedfdccf636d0a643817d12602d0ac6a73f9ded11a82928e8fd
SSDEEP

6144:4K6Loa9O0GrfwCgYzAqtHj+YmyuYdrlRxmjIY5KUrPotYWieqG+cPAN4/HrcLLG4:8PO0CwCgX0ZmyvNLUrAhiHNSVgLLIC

Score

5^/10

Drops file in System32 directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{1EEC6738-F2E5-4ECA-8876-9213382BBCEB}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{1E5E1A88-FC88-4ACC-B145-2FEC906BA29B}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe

C:\Users\Admin\AppData\Local\Temp\51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked_dropper.exe
"C:\Users\Admin\AppData\Local\Temp\51f81493dd1c34c8909d65060b7e96e301e3ec38741660a1248fdc1203b543e8_unpacked_dropper.exe"
1⤵
PID:4328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:1520