fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b

Analysis

max time kernel
139s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 23:21

Target

fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe
Size

557KB
MD5

5e10a4f35d1e216261c730497a20978e
SHA1

483e76742da939ba47def0f085088adcf870be2a
SHA256

fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b
SHA512

e5e47f6e4e6bfd1261572c6c3f4cf36813895a6b380565de633c933533f0a16695909aceb4521e1e7ced58ba341c485f97ecb0250841b336918932c379974934
SSDEEP

12288:EkEzbUd4JFPjRqh1MusAs+rpxPbEHmnqosDfXKP:EkEzbUd+CfsepZbEsXsfaP

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dticisab.nw.dwa	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe
File created	C:\Windows\SysWOW64\dticisab.nt	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe
File opened for modification	C:\Windows\SysWOW64\dticisab.nt	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe
File opened for modification	C:\Windows\SysWOW64\dticisab.nw	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3108	3444	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe	87
PID 3444 wrote to memory of 3108	3444	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe	87
PID 3444 wrote to memory of 3108	3444	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe	87

C:\Users\Admin\AppData\Local\Temp\fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe
"C:\Users\Admin\AppData\Local\Temp\fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$203130531.bat
  2⤵
  PID:3108

C:\Users\Admin\AppData\Local\Temp\$203130531.bat

Filesize
184B

MD5
fbb10f6dc5aeb3fffaa15c2c704b637c

SHA1
12dc2510b7e341dc69a99f109479eb61a461da35

SHA256
9b719d5d36aa512c5bc60e8f04921a220771a9c32e8dbb9a4ca18a9dd8b005da

SHA512
f8f0d0fbcfaeb31a7f80e11f0394d33e5e669be4444eb642f3661776daa588117222e2dbf6986586f6c500abe598b689b6015d3f057d131377cc53e34d6d8aec

Download Submit