f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3

Analysis

max time kernel
182s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 20:44

Target

f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe
Size

514KB
MD5

864d1c0c53b960e378d8bfdcfea8c881
SHA1

976dbeb661095ff675da861f3928bcfd439ecf15
SHA256

f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3
SHA512

0f6e3e7dd8e1727bd68cff0cd849b188901b6cf470417f2623fc52ae08d549cc86831297c9baf3ce74775b77df5927f752e19d9e923856b206bcc1580b599107
SSDEEP

6144:Q0xXBqo+mtNvUzBqBcLb+Vb3aZfhQuSZa5z42qGjZy2D+a48g4vKGggHSawol8UI:lNBqMtNvUF8cveb3aVhQxsURG7gLZ9

Score

8^/10

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\suchost.exe	f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe
File created	C:\Windows\SysWOW64\drivers\suchost.exe	f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe

Executes dropped EXE 1 IoCs

pid	Process
4728	suchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5028	f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe
5028	f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe
4728	suchost.exe
4728	suchost.exe
4728	suchost.exe
4728	suchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4296	5028	f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe	79
PID 5028 wrote to memory of 4296	5028	f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe	79
PID 5028 wrote to memory of 4296	5028	f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe	79
PID 5028 wrote to memory of 4728	5028	f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe	81
PID 5028 wrote to memory of 4728	5028	f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe	81
PID 5028 wrote to memory of 4728	5028	f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe	81

C:\Users\Admin\AppData\Local\Temp\f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe
"C:\Users\Admin\AppData\Local\Temp\f14df7048bd97b80e1bf610e6597fd1193b274ff16011951f28f9aefa4b3abb3.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\54$$.bat
  2⤵
  PID:4296
- C:\Windows\SysWOW64\drivers\suchost.exe
  C:\Windows\system32\drivers\suchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4728

C:\Users\Admin\AppData\Local\Temp\54$$.bat

Filesize
677B

MD5
3484142758e9ae5cc5c9fc2cf1d4717a

SHA1
99ef339c1375a0be2e496d5acfb29a1d1a8a2165

SHA256
5bfc1ed3c34a9d3717539dcaf9e4022b1f356c6e1766ec8b2ccbc4903d2cb5bc

SHA512
3f7b1524eae3ddea0e3cee71afd120afd8de5ab6fe76a6bd09f130e6b50d62dc7ff815f6421d333241a5cbe7b1ec7d509e2464a2725cc1a0de963497f8faf8d9

Download Submit
C:\Windows\SysWOW64\drivers\suchost.exe

Filesize
74KB

MD5
7f2381e7c4c560908817bc5a36fe8ffc

SHA1
b25fd852c91e95ad4830bd8cf43c8443333e3603

SHA256
b93270cdccd52078df2e8405293b038d1ef17238b711270aa0df08ba18e36cc3

SHA512
c6e1358cd8b0a9b3c6a249dd0fa1df27b0f733599bec41eaea92ea2a9a7adfc7d306c4ee1665a7736b09d49c54bc330141a03cbfce9ae927eb35893020e2e8bb

Download Submit
C:\Windows\SysWOW64\drivers\suchost.exe

Filesize
74KB

MD5
7f2381e7c4c560908817bc5a36fe8ffc

SHA1
b25fd852c91e95ad4830bd8cf43c8443333e3603

SHA256
b93270cdccd52078df2e8405293b038d1ef17238b711270aa0df08ba18e36cc3

SHA512
c6e1358cd8b0a9b3c6a249dd0fa1df27b0f733599bec41eaea92ea2a9a7adfc7d306c4ee1665a7736b09d49c54bc330141a03cbfce9ae927eb35893020e2e8bb

Download Submit
memory/4728-139-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/5028-132-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/5028-138-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download