ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 01:37

Target

ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.exe
Size

561KB
MD5

003aad4cef42730cce2ea9b5676dc310
SHA1

b451c3c58e66a8291ce69c8c5ccea321ee4d2d88
SHA256

ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43
SHA512

56b07aadb6a8fb942b6082fbbdc817e42d464f32920e351b054d6b9eaaf6a171e2a82b53b38a1aedeb8a30aae33f0887469ac68b930da6abe16de785467dad57
SSDEEP

6144:s4UHFnuDk67fe2tlw9ay6qOxLfPcvgKVt18CRRVMMMMMM2MMMMMd:6luDk67Q23zKr1zRRaMMMMM2MMMMMd

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
284	ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.com

Loads dropped DLL 2 IoCs

pid	Process
1480	ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.exe
1480	ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kernel.dll	ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.exe
File created	C:\Windows\kernel.dll	ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.exe
File created	C:\Windows\svchost.exe	ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1480	ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 284	1480	ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.exe	26
PID 1480 wrote to memory of 284	1480	ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.exe	26
PID 1480 wrote to memory of 284	1480	ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.exe	26
PID 1480 wrote to memory of 284	1480	ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.exe	26
PID 1480 wrote to memory of 1416	1480	ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.exe	9

C:\Users\Admin\AppData\Local\Temp\ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.com

Filesize
58KB

MD5
85fa260970d0251a459070d324ccf163

SHA1
c0e49ef50e5148e932d8ae22a9a351c3b5a23b30

SHA256
9135272b4d1d47b20f8b2cb8b08da924d0ddfaddc0fac191b044fb16345b80fd

SHA512
87e29abe3ad8a466e5b4dd70fcb6542af52d32e1215f37e933773ea6d39398d688858f233365ac31b0cf71a0e793e191a0a0a70c8e61cf62c08addd22817c866

Download Submit
\Users\Admin\AppData\Local\Temp\ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.com

Filesize
20KB

MD5
7ea9a6eeaed36baca6ecf57e0039c4c7

SHA1
8b82e34cf1c8c68e7f31b0cc9cf42aa09dd16c85

SHA256
852c42c799bb9a005e2db37aa70fd3afb1376cc5c20e26a345e2f3fdb93702b3

SHA512
0ee7aad534c76ad3b68d257db71ed1115a6de0403592850ff5e6878f48a12ce376a9238524a059a5413aa925b6b08abf8acca4e9abd383ad4bd80d43b563792e

Download Submit
\Users\Admin\AppData\Local\Temp\ba65b94788f7f443cbfe962faa267669e853b149f75bb82f0ce7333835aabf43.com

Filesize
66KB

MD5
1233b8d4b373685c467d811a76a07806

SHA1
0a4629e19bfa520555aca277328f27a535d65cc5

SHA256
a95e5fc730649c5fbaab022d17e1c1a83a102edfc0ad92d7ef4dcd5b8dbe963d

SHA512
42d78583ed3183cdcc9f916e5e655ef5ac01565516ba79573238adf89ce73fbfc762e6817c01215c3dc8724d7a5bfb58980bc098725ca448e3e3ae51222d5a71

Download Submit
memory/284-56-0x0000000000000000-mapping.dmp

Download