d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7

Analysis

max time kernel
211s
max time network
223s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:48

Target

d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe
Size

76KB
MD5

bb0b440cbac54114d04648be6f2fe26d
SHA1

bdc7c47001852a8e915f29eaebcf99ffa857c3b5
SHA256

d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7
SHA512

a4fff1a312add0cb1c3cb3ae52bc1ccbce0616453e9f3e9c10c1e631ef7b09503713ef7b922c127ebfd5b57d7315f03c1db42139300752dc22ce429b9a57993e
SSDEEP

1536:pV0nwVFqapIMn8v4YpZxGEN7LbeN7ILYOJcO+tfn:0wuapI0TYZ4N8L6Oqfn

Score

8^/10

discovery

Executes dropped EXE 1 IoCs

Processes:

edgA066.exe

pid process

208 edgA066.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
208	edgA066.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe

description	pid	process	target process
PID 4528 wrote to memory of 208	4528	d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe	edgA066.exe
PID 4528 wrote to memory of 208	4528	d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe	edgA066.exe
PID 4528 wrote to memory of 208	4528	d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe	edgA066.exe

C:\Users\Admin\AppData\Local\Temp\d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe
"C:\Users\Admin\AppData\Local\Temp\d6d846ae3751495ef398ce5af5facfb460ec76b0cb02992905576542d6e548d7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4528

C:\Users\Admin\AppData\Local\edgA066.exe
C:\Users\Admin\AppData\Local\edgA066.exe C:\Users\Admin\AppData\Local\Temp\D6D846~1.EXE cp
2⤵
- Executes dropped EXE
PID:208

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Admin\AppData\Local\edgA066.exe
Filesize
76KB

MD5
7070777c5f77b4369ad2dd15cadfa06e

SHA1
b4f4b426457124ecfeec4d5b59b9c2a6c25baaf7

SHA256
3e7468fd4ced8ff1bf5d6257beb8498ce7c52511256d62514de4e65e4b771dfd

SHA512
20545a4586fbd35c66951f04f29495cf6ce2b73b5f02f66f34ae95b58ba3dbdc3a1816643b6cb891acc98ce0a268b5fff6e6ba5c827c30a1a862a51067b3afa0

Download Submit
memory/208-138-0x0000000000000000-mapping.dmp

Download
memory/4528-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download