2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 23:33

Target

2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.exe
Size

139KB
MD5

a3c2cb7e4c3c83d3ec5b8c3710980fc0
SHA1

f70b9729ad05f722044c6e6f7e5bea3e3b43be31
SHA256

2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48
SHA512

3d1bb2cde0b6571c2a8b773d559a96c281a53c774b721dd468a5377557ce99c8716e6b925e6b802ac275c12bbeb72b77269acda48e7abb42bcadde7e669d56b5
SSDEEP

3072:sdmtrAHFRpxvMDk67fXf4b2IEUAXkGpokGp01L:s4UHFnuDk67fe2j

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
616	2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kernel.dll	2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.exe
File created	C:\Windows\kernel.dll	2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.exe
File created	C:\Windows\svchost.exe	2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
612	2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.exe
612	2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 616	612	2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.exe	83
PID 612 wrote to memory of 616	612	2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.exe	83
PID 612 wrote to memory of 616	612	2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.exe	83
PID 612 wrote to memory of 2948	612	2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.exe	48

C:\Users\Admin\AppData\Local\Temp\2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.com

Filesize
50KB

MD5
fd678f28e9751fede28901d6dc691cda

SHA1
9d8f7031b2d1a106ec43ed3b0542cf48788549fe

SHA256
563b412dc3f49c5648a2c03444ce0c9b4c813d4b0eff15002715da5096b160b2

SHA512
3d8d2744d4b831e55f1243c1ab9877cf0866ad161362f00235dc357c4832c920ded37549d3885842aadb231b83fdb0483e29dba1e46d0ae31274c7a46fe71f89

Download Submit
C:\Users\Admin\AppData\Local\Temp\2c76a44f884cf0921026c763f6435a4f4c6bfce5b561f1e7f71068ad7a6b9f48.com

Filesize
50KB

MD5
fd678f28e9751fede28901d6dc691cda

SHA1
9d8f7031b2d1a106ec43ed3b0542cf48788549fe

SHA256
563b412dc3f49c5648a2c03444ce0c9b4c813d4b0eff15002715da5096b160b2

SHA512
3d8d2744d4b831e55f1243c1ab9877cf0866ad161362f00235dc357c4832c920ded37549d3885842aadb231b83fdb0483e29dba1e46d0ae31274c7a46fe71f89

Download Submit