aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 14:23

Target

aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.exe
Size

477KB
MD5

a3190270673e20a1dfb6ec4042d77ae0
SHA1

94485306d6a35fffef56d6e97311da15b403cdb0
SHA256

aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428
SHA512

bfe42a4e5780f78cc51a413898522f62192f014f151da75cf5ba363b6b814e66c21ee9978aa122d0de6fce5e776ed29883322c74bd39ec25fd6adaceef7efd0c
SSDEEP

3072:sdmtrAHFRpxvMDk67fXf4b2IEUAXkGpokGp01xGGg4OxL86PcvgKOEtge:s4UHFnuDk67fe2cqOxLfPcvgKVT

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
608	aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.com

Loads dropped DLL 2 IoCs

pid	Process
1648	aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.exe
1648	aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\kernel.dll	aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.exe
File created	C:\Windows\svchost.exe	aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.exe
File opened for modification	C:\Windows\kernel.dll	aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1648	aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 608	1648	aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.exe	28
PID 1648 wrote to memory of 608	1648	aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.exe	28
PID 1648 wrote to memory of 608	1648	aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.exe	28
PID 1648 wrote to memory of 608	1648	aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.exe	28
PID 1648 wrote to memory of 1372	1648	aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.exe	14

C:\Users\Admin\AppData\Local\Temp\aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.com

Filesize
388KB

MD5
3d9cc61fcd252da2261b912d41538a34

SHA1
3005263ba1bc922b12aa5200f971d2b2dbfd105e

SHA256
2aab084593683dcbab029176f47d6a39c1c2103802187e8b0c5d63147d729473

SHA512
10c926ce53cb3326f7633f305044f3880918a8821aab7269708c289154e947e60d31d02648ec578eb64a734805d4d77fb6df1d993b5c8bf2dedaf9e7c0587f48

Download Submit
\Users\Admin\AppData\Local\Temp\aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.com

Filesize
388KB

MD5
3d9cc61fcd252da2261b912d41538a34

SHA1
3005263ba1bc922b12aa5200f971d2b2dbfd105e

SHA256
2aab084593683dcbab029176f47d6a39c1c2103802187e8b0c5d63147d729473

SHA512
10c926ce53cb3326f7633f305044f3880918a8821aab7269708c289154e947e60d31d02648ec578eb64a734805d4d77fb6df1d993b5c8bf2dedaf9e7c0587f48

Download Submit
\Users\Admin\AppData\Local\Temp\aea1ef16c7550b3d7c08af366c1d371ac9365c674eeffbf9444e3472d8ddc428.com

Filesize
388KB

MD5
3d9cc61fcd252da2261b912d41538a34

SHA1
3005263ba1bc922b12aa5200f971d2b2dbfd105e

SHA256
2aab084593683dcbab029176f47d6a39c1c2103802187e8b0c5d63147d729473

SHA512
10c926ce53cb3326f7633f305044f3880918a8821aab7269708c289154e947e60d31d02648ec578eb64a734805d4d77fb6df1d993b5c8bf2dedaf9e7c0587f48

Download Submit