cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa

Analysis

max time kernel
194s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:54

Target

cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe
Size

64KB
MD5

a2e6974898a15c0462fee8e10f16a745
SHA1

fc9e925758d53ce8f5ae94ce0950ec1689448cdc
SHA256

cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa
SHA512

1d666c786b25b5c4965a2d9fc821f803ffcd5e946b0346c7b5ae77561106458fdff5e2ab91f17d58dc2d22355f8793ec36c990d2353b75b6890f064a390fda9f
SSDEEP

768:uBVEmPwQdi0DLr4OCfCBFd0qX+l5/yo7X34zVwcQUpdPwaeWvJ+XCDDAihvESIXw:uUegaBFp0h7XoB7QUpFOWwXtiZyXGP

Score

8^/10

discovery

Executes dropped EXE 1 IoCs

Processes:

edg4B22.exe

pid process

4124 edg4B22.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4124	edg4B22.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe

description	pid	process	target process
PID 3500 wrote to memory of 4124	3500	cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe	edg4B22.exe
PID 3500 wrote to memory of 4124	3500	cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe	edg4B22.exe
PID 3500 wrote to memory of 4124	3500	cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe	edg4B22.exe

C:\Users\Admin\AppData\Local\Temp\cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe
"C:\Users\Admin\AppData\Local\Temp\cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3500

C:\Users\Admin\AppData\Local\edg4B22.exe
C:\Users\Admin\AppData\Local\edg4B22.exe C:\Users\Admin\AppData\Local\Temp\CD37B9~1.EXE cp
2⤵
- Executes dropped EXE
PID:4124

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Admin\AppData\Local\edg4B22.exe
Filesize
64KB

MD5
e9ba4c186c4ccd8c04f5e80c6c3f15e6

SHA1
1f3e69628070e7d36279f51d02fcdfa7b143d097

SHA256
b8e7f38bf6c78d592f0f43cbaa59b28b397a95e59dd7db5a99d892a6a237280d

SHA512
b6a43aa7996c938684ce4264feba63b2dfc9f1ac3d26966722e57ed07948e89863d63aad9c545bc0af4820b07195db4b2c418d849f8041f449eb05f58a4a1941

Download Submit
memory/3500-132-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4124-138-0x0000000000000000-mapping.dmp

Download