0264f793019aa3bcfb0eea21eb639a14f41005a6edb5ea619171953a257bb4c5

Analysis

max time kernel
342s
max time network
400s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 05:05

Target

0264f793019aa3bcfb0eea21eb639a14f41005a6edb5ea619171953a257bb4c5.exe
Size

23KB
MD5

c18abb88e4ee9b92b87fcd373b0fe1cf
SHA1

77277a63e68511719cd59f08f5ad4ad3022a710c
SHA256

0264f793019aa3bcfb0eea21eb639a14f41005a6edb5ea619171953a257bb4c5
SHA512

e53bb7691d2ab50bf37ec72c0fd28b3141181e0d1482505942d953e50b271348e95e9d3855e633bec9e7d9bd2da688eed358eadc988802703d050e300e12908e
SSDEEP

384:bluBPiZCMfdfSJrQbsLRGSIxYVL46pg/i8BD9BmRvR6JZlbw8hqIusZzZ8jo:kOmhtIiRpcnuU

Score

5^/10

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F890A214-BE06-4325-95E2-00CCDE5D79BA}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{90DEA84A-4E84-4068-B921-B4B384857847}.catalogItem	svchost.exe

C:\Users\Admin\AppData\Local\Temp\0264f793019aa3bcfb0eea21eb639a14f41005a6edb5ea619171953a257bb4c5.exe
"C:\Users\Admin\AppData\Local\Temp\0264f793019aa3bcfb0eea21eb639a14f41005a6edb5ea619171953a257bb4c5.exe"
1⤵
PID:4920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:4896

memory/4920-132-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download