8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc

Analysis

max time kernel
122s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 14:24

Target

8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.exe
Size

360KB
MD5

a2d35d303e53ec8b2f2dc5f6ea56d3d0
SHA1

486a3be419d959e971534671e57635d1b62fe9eb
SHA256

8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc
SHA512

8aefd9792f6caa1e099798bf0adea774eeb0dc4b2b754e96564a08e95c621fef99d8478ae3009e388a07530051c24ad73b50caa3d1bdf395e53487ace6abdadb
SSDEEP

6144:s4UHFnuDk67fe2uvePPMqLckUet72FwBI+AFdb8Mu9NSDyDRO1thp0:6luDk67SaMVkUet7EwBI+APuHSDyo1t4

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4788	8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\kernel.dll	8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.exe
File created	C:\Windows\kernel.dll	8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.exe
File created	C:\Windows\svchost.exe	8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1532	8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.exe
1532	8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 4788	1532	8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.exe	83
PID 1532 wrote to memory of 4788	1532	8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.exe	83
PID 1532 wrote to memory of 4788	1532	8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.exe	83
PID 1532 wrote to memory of 1040	1532	8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.exe	32

C:\Users\Admin\AppData\Local\Temp\8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.com

Filesize
271KB

MD5
a3a3300c1595218e29a2920e8abcfc0a

SHA1
c19d0f4311df3039f2a279d7986642cc224b5df0

SHA256
59365a8a774e8f2e29902c7be460876755b342c033095378467b65269b3e7e71

SHA512
8ed0c2eec78bb947099d015006d72f291e8b2ed907d25999f30239fcbbe4f5734a7840428cb5918a082f94c4bfbf39f300e94cd0737871da69d7e36cbf994de7

Download Submit
C:\Users\Admin\AppData\Local\Temp\8541e021d31ab4e7887b2cfa2b4ebc9c5e1b162d1e2db328d60b23c57fe5cfbc.com

Filesize
271KB

MD5
a3a3300c1595218e29a2920e8abcfc0a

SHA1
c19d0f4311df3039f2a279d7986642cc224b5df0

SHA256
59365a8a774e8f2e29902c7be460876755b342c033095378467b65269b3e7e71

SHA512
8ed0c2eec78bb947099d015006d72f291e8b2ed907d25999f30239fcbbe4f5734a7840428cb5918a082f94c4bfbf39f300e94cd0737871da69d7e36cbf994de7

Download Submit