0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1

Analysis

max time kernel
13s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 14:21

Target

0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe
Size

149KB
MD5

a3243d22688fb9738ea4445cfa11f4d0
SHA1

a1d4833adf5d84b63c6dc82dbe58632888ebdb59
SHA256

0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1
SHA512

f460423497b0d7efc0db4533fb2a7ebd55e19cd98951dee05f65af624e255612e7defea51479dfffcec2c3989b82d02f564ef6905a10d98d23dfe74803bfee46
SSDEEP

3072:TO3ZhHsio0tBGCzoR96PAf+Q8wJno2lKiXNbB:TkhMipt0Czowlw9ay

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3500	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe
File opened for modification	C:\Windows\svchost.exe	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe
File opened for modification	C:\Windows\kernel.dll	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe
File created	C:\Windows\kernel.dll	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1972	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe
1972	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 3500	1972	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe	78
PID 1972 wrote to memory of 3500	1972	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe	78
PID 1972 wrote to memory of 3500	1972	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe	78
PID 1972 wrote to memory of 2688	1972	0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.exe	40

C:\Users\Admin\AppData\Local\Temp\0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.com

Filesize
72KB

MD5
48cdab5eb8c952534ae2c5aed72ccb70

SHA1
a68607d6b1fe806be5dd2ead33a63a577ae60193

SHA256
5b971c4875dc29c80712c205d36c1ebdb6633494b02623eb13246512a34ae7f8

SHA512
8c9e69e577a0cda8e520e8d739c3366499770ff175eef5094ecd0534eaddf8b1cbd6f8928c112f080d4a72f45d7b781ccd7767e484a1616917590403e463a2fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\0aa238cabf5cfce237d3c0e9aa1d11da51c01b7ccadda561fbb7b783faf5aba1.com

Filesize
72KB

MD5
48cdab5eb8c952534ae2c5aed72ccb70

SHA1
a68607d6b1fe806be5dd2ead33a63a577ae60193

SHA256
5b971c4875dc29c80712c205d36c1ebdb6633494b02623eb13246512a34ae7f8

SHA512
8c9e69e577a0cda8e520e8d739c3366499770ff175eef5094ecd0534eaddf8b1cbd6f8928c112f080d4a72f45d7b781ccd7767e484a1616917590403e463a2fa

Download Submit