bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a

Analysis

max time kernel
186s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 14:28

Target

bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe
Size

640KB
MD5

955de299fc267be409cc8c97216a9dc7
SHA1

b7c7a4abfa7d24e5c1cc7a3bfafad15352569195
SHA256

bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a
SHA512

4867ac34959080b1dfa5f66d798b20a953e4ff4c2cee42cab0ec1931a53be2ce881a9c39d5d1f4c0961a7f25348d4f1ea3e15500e9f964800a6d44d157dd4707
SSDEEP

12288:DoNbu9oOXiCeDJ59xeVV0bfcEl+ohJlrI0L2Fh7IHrsf6:DNoXCe9nCDAD2FKrA

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1968	netdde.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\netdde.exe	bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2204	bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe
2204	bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe
2204	bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe
2204	bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe
2204	bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe
2204	bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1968	2204	bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe	78
PID 2204 wrote to memory of 1968	2204	bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe	78
PID 2204 wrote to memory of 1968	2204	bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe	78

C:\Users\Admin\AppData\Local\Temp\bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe
"C:\Users\Admin\AppData\Local\Temp\bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\netdde.exe
  C:\Windows\system32\netdde.exe
  2⤵
  - Executes dropped EXE
  PID:1968

C:\Windows\SysWOW64\netdde.exe

Filesize
640KB

MD5
955de299fc267be409cc8c97216a9dc7

SHA1
b7c7a4abfa7d24e5c1cc7a3bfafad15352569195

SHA256
bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a

SHA512
4867ac34959080b1dfa5f66d798b20a953e4ff4c2cee42cab0ec1931a53be2ce881a9c39d5d1f4c0961a7f25348d4f1ea3e15500e9f964800a6d44d157dd4707

Download Submit
C:\Windows\SysWOW64\netdde.exe

Filesize
640KB

MD5
955de299fc267be409cc8c97216a9dc7

SHA1
b7c7a4abfa7d24e5c1cc7a3bfafad15352569195

SHA256
bec4e7e10c2b2bdbc2137794570778c7499df305739ecb4e915524a0ea77197a

SHA512
4867ac34959080b1dfa5f66d798b20a953e4ff4c2cee42cab0ec1931a53be2ce881a9c39d5d1f4c0961a7f25348d4f1ea3e15500e9f964800a6d44d157dd4707

Download Submit
memory/1968-136-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2204-132-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2204-137-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download