0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 14:21

Target

0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe
Size

149KB
MD5

a3243d22688fb9738ea4445cfa11f4d0
SHA1

a1d4833adf5d84b63c6dc82dbe58632888ebdb59
SHA256

0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1
SHA512

f460423497b0d7efc0db4533fb2a7ebd55e19cd98951dee05f65af624e255612e7defea51479dfffcec2c3989b82d02f564ef6905a10d98d23dfe74803bfee46
SSDEEP

3072:TO3ZhHsio0tBGCzoR96PAf+Q8wJno2lKiXNbB:TkhMipt0Czowlw9ay

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1056	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.com

Loads dropped DLL 2 IoCs

pid	Process
1088	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe
1088	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kernel.dll	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe
File created	C:\Windows\kernel.dll	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe
File created	C:\Windows\svchost.exe	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe
File opened for modification	C:\Windows\svchost.exe	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1088	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1056	1088	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe	26
PID 1088 wrote to memory of 1056	1088	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe	26
PID 1088 wrote to memory of 1056	1088	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe	26
PID 1088 wrote to memory of 1056	1088	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe	26
PID 1088 wrote to memory of 1416	1088	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe	17

C:\Users\Admin\AppData\Local\Temp\0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.com

Filesize
72KB

MD5
48cdab5eb8c952534ae2c5aed72ccb70

SHA1
a68607d6b1fe806be5dd2ead33a63a577ae60193

SHA256
5b971c4875dc29c80712c205d36c1ebdb6633494b02623eb13246512a34ae7f8

SHA512
8c9e69e577a0cda8e520e8d739c3366499770ff175eef5094ecd0534eaddf8b1cbd6f8928c112f080d4a72f45d7b781ccd7767e484a1616917590403e463a2fa

Download Submit
\Users\Admin\AppData\Local\Temp\0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.com

Filesize
72KB

MD5
48cdab5eb8c952534ae2c5aed72ccb70

SHA1
a68607d6b1fe806be5dd2ead33a63a577ae60193

SHA256
5b971c4875dc29c80712c205d36c1ebdb6633494b02623eb13246512a34ae7f8

SHA512
8c9e69e577a0cda8e520e8d739c3366499770ff175eef5094ecd0534eaddf8b1cbd6f8928c112f080d4a72f45d7b781ccd7767e484a1616917590403e463a2fa

Download Submit
\Users\Admin\AppData\Local\Temp\0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.com

Filesize
72KB

MD5
48cdab5eb8c952534ae2c5aed72ccb70

SHA1
a68607d6b1fe806be5dd2ead33a63a577ae60193

SHA256
5b971c4875dc29c80712c205d36c1ebdb6633494b02623eb13246512a34ae7f8

SHA512
8c9e69e577a0cda8e520e8d739c3366499770ff175eef5094ecd0534eaddf8b1cbd6f8928c112f080d4a72f45d7b781ccd7767e484a1616917590403e463a2fa

Download Submit
memory/1056-58-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download