466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0

Analysis

max time kernel
141s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:41

Target

466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0.exe
Size

331KB
MD5

dfe76bc3b90ec0ed3f1eae633e171036
SHA1

f6dba131f3c68b464d2ee2f0a352e8e06347051f
SHA256

466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0
SHA512

e350a68e271cd1a9855000aee9534c0c838aeeff6e4d0964903db854f4c6555adbd301a93f20238038ae9b779644ac5532fcd16131141221acdc0e494bc16344
SSDEEP

6144:0VtEBz7HnQinbej/qC3BFr1Z7ZmeHmshtcEfaISmYaPdH58glVZiuT:6tazjnOGC3jL7AwXhaEfaISm7158gTZi

Score

8^/10

aspackv2

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

Processes:

resource	yara_rule
C:\Windows\SysWOW64\svchusts.exe	aspack_v212_v242
C:\Windows\SysWOW64\svchusts.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

svchusts.exe

pid process

3784 svchusts.exe

pid	process
3784	svchusts.exe

Drops file in System32 directory 3 IoCs

Processes:

466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0.exesvchusts.exe

description	ioc	process
File created	C:\Windows\SysWOW64\svchusts.exe	466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0.exe
File opened for modification	C:\Windows\SysWOW64\svchusts.exe	466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0.exe
File opened for modification	C:\Windows\SysWOW64\svchusts.exe	svchusts.exe

Drops file in Windows directory 1 IoCs

Processes:

466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0.exe

description ioc process

File created C:\Windows\DEWEFDDSFS.BAT 466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0.exe

description	ioc	process
File created	C:\Windows\DEWEFDDSFS.BAT	466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0.exe

description	pid	process	target process
PID 4884 wrote to memory of 3252	4884	466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0.exe	cmd.exe
PID 4884 wrote to memory of 3252	4884	466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0.exe	cmd.exe
PID 4884 wrote to memory of 3252	4884	466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\DEWEFDDSFS.BAT
2⤵
PID:3252

C:\Windows\DEWEFDDSFS.BAT

Filesize
254B

MD5
2095d7334a852dbdb854612fe7f015e0

SHA1
5ff840053ecebf98681f21731e8ce60f19593230

SHA256
f6408659daed6aad166115d37827a341871006110184ae5e9ae8cd4ec3e19c5a

SHA512
033e54fc55ea97bc345c02ac08d930c72fae18b56f6695546ee4bf51e3a74637b9b1c57d985e4df7f4130b02a6fcb608dbe072385ad87589153346efc721a914

Download Submit
C:\Windows\SysWOW64\svchusts.exe

Filesize
331KB

MD5
dfe76bc3b90ec0ed3f1eae633e171036

SHA1
f6dba131f3c68b464d2ee2f0a352e8e06347051f

SHA256
466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0

SHA512
e350a68e271cd1a9855000aee9534c0c838aeeff6e4d0964903db854f4c6555adbd301a93f20238038ae9b779644ac5532fcd16131141221acdc0e494bc16344

Download Submit
C:\Windows\SysWOW64\svchusts.exe

Filesize
331KB

MD5
dfe76bc3b90ec0ed3f1eae633e171036

SHA1
f6dba131f3c68b464d2ee2f0a352e8e06347051f

SHA256
466604e8d5c7aab494361d6a92c6a53ba577ce2615bd70f4fd31a10349329da0

SHA512
e350a68e271cd1a9855000aee9534c0c838aeeff6e4d0964903db854f4c6555adbd301a93f20238038ae9b779644ac5532fcd16131141221acdc0e494bc16344

Download Submit
memory/3252-134-0x0000000000000000-mapping.dmp

Download