5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 23:29

Target

5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.exe
Size

149KB
MD5

a3b3b112340fa7678b1d39883fddc600
SHA1

2a730487025cddd8bcd4813cfa8a12472d23ad2a
SHA256

5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d
SHA512

342488796726bedd00c93e3aec591c206829358aba8f5d5f732be9a0700bf253739084f85a8189e29b9922313f4cc1e126ee277fb74e58544ff88d8c3fa424d0
SSDEEP

3072:TO3ZhHsio0tBGCzoRj6PAf+Q8wJno2lKiXNbB:TkhMipt0Czo+lw9ay

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3608	5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\kernel.dll	5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.exe
File created	C:\Windows\svchost.exe	5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.exe
File opened for modification	C:\Windows\svchost.exe	5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.exe
File opened for modification	C:\Windows\kernel.dll	5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4744	5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.exe
4744	5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 3608	4744	5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.exe	81
PID 4744 wrote to memory of 3608	4744	5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.exe	81
PID 4744 wrote to memory of 3608	4744	5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.exe	81
PID 4744 wrote to memory of 3032	4744	5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.exe	47

C:\Users\Admin\AppData\Local\Temp\5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.com

Filesize
72KB

MD5
48cdab5eb8c952534ae2c5aed72ccb70

SHA1
a68607d6b1fe806be5dd2ead33a63a577ae60193

SHA256
5b971c4875dc29c80712c205d36c1ebdb6633494b02623eb13246512a34ae7f8

SHA512
8c9e69e577a0cda8e520e8d739c3366499770ff175eef5094ecd0534eaddf8b1cbd6f8928c112f080d4a72f45d7b781ccd7767e484a1616917590403e463a2fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e6c52f13fb5e8bcf9ce553459dc695067f4aad4aaf1d363d91b7029e602ab8d.com

Filesize
72KB

MD5
48cdab5eb8c952534ae2c5aed72ccb70

SHA1
a68607d6b1fe806be5dd2ead33a63a577ae60193

SHA256
5b971c4875dc29c80712c205d36c1ebdb6633494b02623eb13246512a34ae7f8

SHA512
8c9e69e577a0cda8e520e8d739c3366499770ff175eef5094ecd0534eaddf8b1cbd6f8928c112f080d4a72f45d7b781ccd7767e484a1616917590403e463a2fa

Download Submit