bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d

Analysis

max time kernel
90s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 14:23

Target

bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.exe
Size

502KB
MD5

a330cadf9c8046acd1cbee77729bc400
SHA1

615ca286914ce4a181c8fc4e493d9dc534af2c56
SHA256

bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d
SHA512

38054a3a319f5094e57b088ad04a0e8950e33dc30ca5833dc07db8fb9e2dd021e48fc2151311f4114e7838af073334a02e7148325e4bbd6e5b40402cc8bc9194
SSDEEP

6144:s4UHFnuDk67fe2tlw9ay6qOxLfPcvgKVM:6luDk67Q23zK2

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1624	bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kernel.dll	bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.exe
File created	C:\Windows\kernel.dll	bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.exe
File created	C:\Windows\svchost.exe	bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4788	bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.exe
4788	bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 1624	4788	bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.exe	81
PID 4788 wrote to memory of 1624	4788	bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.exe	81
PID 4788 wrote to memory of 1624	4788	bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.exe	81
PID 4788 wrote to memory of 2932	4788	bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.exe	72

C:\Users\Admin\AppData\Local\Temp\bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.com

Filesize
414KB

MD5
40b8f5fb16cef8a5c14c94066bce03a7

SHA1
f13299f14f199ce8ae9de97daa350a140c8fbb18

SHA256
ba3fbd81d5b92f36a9ef60ffd2267b899a05396c50c24cfedb02493b81c64bfc

SHA512
3b069547ad3a71fb90f7ee59efa991fb56d3a48cb04b79365388a602b437654e1a91ca6b3e92ae2a75dfbed040d8384359ce49e978ea8062aeec6742f9b650c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\bb40b64ebf8ce3e0decc3b620537559e0ab0240701386c5f9bd3fcfe5d2c859d.com

Filesize
414KB

MD5
40b8f5fb16cef8a5c14c94066bce03a7

SHA1
f13299f14f199ce8ae9de97daa350a140c8fbb18

SHA256
ba3fbd81d5b92f36a9ef60ffd2267b899a05396c50c24cfedb02493b81c64bfc

SHA512
3b069547ad3a71fb90f7ee59efa991fb56d3a48cb04b79365388a602b437654e1a91ca6b3e92ae2a75dfbed040d8384359ce49e978ea8062aeec6742f9b650c2

Download Submit