1a547c208c4323f9d5708a095956dae9cc1941010fbec28f1b067dc91021eb45

Analysis

max time kernel
92s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 14:21

Target

1a547c208c4323f9d5708a095956dae9cc1941010fbec28f1b067dc91021eb45.exe
Size

77KB
MD5

a2f046afebdf6617ecb0f8ff82139e10
SHA1

2af354b477b32d8eea7370b1abde373e736d6218
SHA256

1a547c208c4323f9d5708a095956dae9cc1941010fbec28f1b067dc91021eb45
SHA512

676dd294d2b852d36486292021ad8ff597a7fa22fe750735cd56f6a0ec456880b5cac8688b32e1a6e72cb527b657768e75b617aa777d7b5fe60d485f5c6ddbb6
SSDEEP

1536:TO+AZhCZFcsifjE0SJIB/6pCypfoe6WH/RgW:TO3ZhHsio0tBGCzoR3

Score

4^/10

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kernel.dll	1a547c208c4323f9d5708a095956dae9cc1941010fbec28f1b067dc91021eb45.exe
File created	C:\Windows\kernel.dll	1a547c208c4323f9d5708a095956dae9cc1941010fbec28f1b067dc91021eb45.exe
File created	C:\Windows\svchost.exe	1a547c208c4323f9d5708a095956dae9cc1941010fbec28f1b067dc91021eb45.exe
File opened for modification	C:\Windows\svchost.exe	1a547c208c4323f9d5708a095956dae9cc1941010fbec28f1b067dc91021eb45.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2400	1a547c208c4323f9d5708a095956dae9cc1941010fbec28f1b067dc91021eb45.exe
2400	1a547c208c4323f9d5708a095956dae9cc1941010fbec28f1b067dc91021eb45.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 3068	2400	1a547c208c4323f9d5708a095956dae9cc1941010fbec28f1b067dc91021eb45.exe	17