9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27

Analysis

max time kernel
135s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 15:28

Target

9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.exe
Size

502KB
MD5

0d03f556ca1f061f83d56d9ea11ff920
SHA1

8ccb890195f1e364d2bfbbff9a6c2feddc535550
SHA256

9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27
SHA512

771f875126b632b6f5192fe48ced04fda1b72d7c664116f131af6c911ceb232c7591acae9f728bbc34a10c799149f4734f05a1304ac02d2e7eeb9d60d326a70a
SSDEEP

6144:s4UHFnuDk67fe2tlw9ay6qOxLfPcvgKVS:6luDk67Q23zKM

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4176	9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\kernel.dll	9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.exe
File created	C:\Windows\svchost.exe	9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.exe
File opened for modification	C:\Windows\kernel.dll	9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4248	9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.exe
4248	9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4176	4248	9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.exe	80
PID 4248 wrote to memory of 4176	4248	9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.exe	80
PID 4248 wrote to memory of 4176	4248	9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.exe	80
PID 4248 wrote to memory of 2712	4248	9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.exe	53

C:\Users\Admin\AppData\Local\Temp\9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.com

Filesize
414KB

MD5
0305e2e6044209318dec06450470ba0d

SHA1
fda0ec10db6af810eaa0a1e500f1db90bc88955c

SHA256
b2f2b5a33d98939265261f4aa0701f1b66780e08b42ae3997acfbc2125dd95e0

SHA512
af2bee2c5c6244842bab758e28180887d538da4fa57415820df1d6095cdce9a605e15d8b2f1d18cbadf16cd16ffd6333910ade83cf13b405e38c77b295f4cea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ab54cc29b027cea4b6af8ee4b7955d236b6b7538b53dbd12e5de6860936eb27.com

Filesize
414KB

MD5
0305e2e6044209318dec06450470ba0d

SHA1
fda0ec10db6af810eaa0a1e500f1db90bc88955c

SHA256
b2f2b5a33d98939265261f4aa0701f1b66780e08b42ae3997acfbc2125dd95e0

SHA512
af2bee2c5c6244842bab758e28180887d538da4fa57415820df1d6095cdce9a605e15d8b2f1d18cbadf16cd16ffd6333910ade83cf13b405e38c77b295f4cea9

Download Submit