97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1

Analysis

max time kernel
189s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 06:27

Target

97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe
Size

732KB
MD5

528fe44cdf6d496b1c5d03b501845df3
SHA1

ed2378b13912beab3d73961f0b5485bd3e391c85
SHA256

97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1
SHA512

1fe849a061d82eae94c887fb2630c1446c9792f060cf988cb250a50da67b979dc3aa7a559b7ef72037bd6f7787f71bec3d9f0f512882fdd93f7c2f9e99ece23b
SSDEEP

12288:3+R9FGm7wT+j2uoGKPfVQIk9lS7+smzjugzaFtoteAXKzkN9O6qhTopxxh:OzPHChXVQpSmzSg2lbzkHj6Tov

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\2ad23f725d.dll	97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 756	812	97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe	80
PID 812 wrote to memory of 756	812	97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe	80
PID 812 wrote to memory of 756	812	97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe	80

C:\Users\Admin\AppData\Local\Temp\97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe
"C:\Users\Admin\AppData\Local\Temp\97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$30689.bat
  2⤵
  PID:756

C:\Users\Admin\AppData\Local\Temp\$$30689.bat

Filesize
181B

MD5
05e0ecfce889ea0154c1e11945509901

SHA1
adc724db4ab5a6ad5f7b39e80feb50b7b45cc4f9

SHA256
39febb0a278deb8606f81cafb6fc636b7b4f57449b9e1ef36e228867eb3ce2a3

SHA512
2947b0f8089c4321cd26192d4d2da321ae47ffac36e0711f69bb9ccbaf12117a31260575927b018b7439390878f0a9ac3cc6a2e3dd37f09d4f20bd9a4969da90

Download Submit
memory/812-132-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/812-133-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/812-135-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download