fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70

Analysis

max time kernel
169s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 08:20

Target

fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
Size

388KB
MD5

fcd4387492a11919128ee95548267af3
SHA1

928ac32f2e41ba1fe43cb72c2100ccbdb03cc7fb
SHA256

fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70
SHA512

51d47c501f3b6ec1385aa59a21782cf78f006d6bcd35721e0891dc8abe59100c8ae37612ea332362426ba9e9059bf82ed2ecf80ebc8990141df51148053612dd
SSDEEP

6144:YFfVw/fi6O4knMMCOdF7xJTl3CjrlsCmRg/xj8tiLrsHV0H6gaD34Io:YhCa6OlPzJxSyCmah8tiLrsuafD34H

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.tlb	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
File created	C:\Windows\SysWOW64\mPelT.tlb	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
File created	C:\Windows\SysWOW64\Stub.exe.exe.txt	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
File created	C:\Windows\SysWOW64\Tlb_writeprocessmemory.tlb	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4476 set thread context of 4560	4476	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	78

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4476	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4560	4476	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	78
PID 4476 wrote to memory of 4560	4476	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	78
PID 4476 wrote to memory of 4560	4476	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	78
PID 4476 wrote to memory of 4560	4476	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	78
PID 4476 wrote to memory of 4560	4476	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	78
PID 4476 wrote to memory of 4560	4476	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	78
PID 4476 wrote to memory of 4560	4476	fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe	78

C:\Users\Admin\AppData\Local\Temp\fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
"C:\Users\Admin\AppData\Local\Temp\fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\AppData\Local\Temp\fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
  C:\Users\Admin\AppData\Local\Temp\fcae8ae10ba89949d16272cbbf3b600b7f26b41ecccd751fbe465b90d19c6d70.exe
  2⤵
  PID:4560

memory/4476-132-0x0000000000400000-0x000000000068E000-memory.dmp

Filesize
2.6MB

Download
memory/4476-135-0x0000000000400000-0x000000000068E000-memory.dmp

Filesize
2.6MB

Download
memory/4476-139-0x0000000000400000-0x000000000068E000-memory.dmp

Filesize
2.6MB

Download
memory/4560-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4560-140-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4560-141-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download