67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161

Analysis

max time kernel
40s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 22:09

Target

67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe
Size

34KB
MD5

0cc3c3b7da5e9c3aff29c73a91c57521
SHA1

a76b4ab3566036d33f847c2129113c3cdede47b2
SHA256

67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161
SHA512

6872a763b79883e53be5a70f4d2914d84c998f64456dcf6568faf5ad2ce1385d3e5fc1688c6d716e540d474b396fbb0953f7caff7f24105d4e635caf0c252b20
SSDEEP

768:w7dxDakM/ZRSuMIj9g22EdaJrT5NfYthCyFkUE45RgbpnxOTTZu:KG9RSuMIpgEdaJR56MyM45Sph

Score

7^/10

Unexpected DNS network traffic destination 24 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kernel32.exe	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe
File created	C:\Windows\SysWOW64\rremo.exe	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe
File opened for modification	C:\Windows\SysWOW64\rremo.exe	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe
File opened for modification	C:\Windows\SysWOW64\kernel32.exe	iexplore.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3324 set thread context of 4892	3324	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe	82
PID 3324 set thread context of 4208	3324	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe	83

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 4892	3324	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe	82
PID 3324 wrote to memory of 4892	3324	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe	82
PID 3324 wrote to memory of 4892	3324	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe	82
PID 3324 wrote to memory of 4892	3324	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe	82
PID 3324 wrote to memory of 4208	3324	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe	83
PID 3324 wrote to memory of 4208	3324	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe	83
PID 3324 wrote to memory of 4208	3324	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe	83
PID 3324 wrote to memory of 4208	3324	67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe	83

C:\Users\Admin\AppData\Local\Temp\67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe
"C:\Users\Admin\AppData\Local\Temp\67e437c2072cfbf80db9a1b760bc14c84954111c16f87d6a3ac00e5f2c6f7161.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Drops file in System32 directory
  PID:4892
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:4208

memory/3324-132-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3324-133-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3324-138-0x0000000076EA0000-0x0000000076F90000-memory.dmp

Filesize
960KB

Download
memory/3324-137-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3324-136-0x0000000076EA0000-0x0000000076F90000-memory.dmp

Filesize
960KB

Download
memory/3324-139-0x0000000076EA0000-0x0000000076F90000-memory.dmp

Filesize
960KB

Download
memory/3324-140-0x0000000076EA0000-0x0000000076F90000-memory.dmp

Filesize
960KB

Download
memory/3324-142-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3324-143-0x0000000076EA0000-0x0000000076F90000-memory.dmp

Filesize
960KB

Download