a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e

Analysis

max time kernel
100s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 18:17

Target

a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e.exe
Size

323KB
MD5

884e059425047f2c3271a88e482e486f
SHA1

a9003c333dacc6552949d7962c261841f0ca406c
SHA256

a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e
SHA512

2875ef89d213195a740cbf5b8640bc92dceb5cfe86739d2111d324d583a929847f0f8fcd0d4fff84b6959b3cfeedfb769a8680670c3e0bd18c4ec118abd755e8
SSDEEP

1536:u8rBDZgFLJzSLWTppiU5BnD8SlNDSzvHF5OaeCCVpguN4eSe+eooOoaoCoCo0oBR:5lZgFLGepiU5BAQ7

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4200	Del3326.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\zxcvv.vbs	a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e.exe
File opened for modification	C:\WINDOWS\zxcvv.vbs	Del3326.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4912	4388	a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e.exe	81
PID 4388 wrote to memory of 4912	4388	a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e.exe	81
PID 4388 wrote to memory of 4912	4388	a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e.exe	81
PID 4388 wrote to memory of 4200	4388	a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e.exe	82
PID 4388 wrote to memory of 4200	4388	a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e.exe	82
PID 4388 wrote to memory of 4200	4388	a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e.exe	82
PID 4200 wrote to memory of 5028	4200	Del3326.tmp	83
PID 4200 wrote to memory of 5028	4200	Del3326.tmp	83
PID 4200 wrote to memory of 5028	4200	Del3326.tmp	83

C:\Users\Admin\AppData\Local\Temp\a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e.exe
"C:\Users\Admin\AppData\Local\Temp\a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\wscript.exe
  /nologo C:\WINDOWS\zxcvv.vbs
  2⤵
  PID:4912
- C:\Users\Admin\AppData\Local\Temp\Del3326.tmp
  C:\Users\Admin\AppData\Local\Temp\Del3326.tmp 492 "C:\Users\Admin\AppData\Local\Temp\a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\SysWOW64\wscript.exe
    /nologo C:\WINDOWS\zxcvv.vbs
    3⤵
    PID:5028

C:\Users\Admin\AppData\Local\Temp\Del3326.tmp

Filesize
323KB

MD5
884e059425047f2c3271a88e482e486f

SHA1
a9003c333dacc6552949d7962c261841f0ca406c

SHA256
a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e

SHA512
2875ef89d213195a740cbf5b8640bc92dceb5cfe86739d2111d324d583a929847f0f8fcd0d4fff84b6959b3cfeedfb769a8680670c3e0bd18c4ec118abd755e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Del3326.tmp

Filesize
323KB

MD5
884e059425047f2c3271a88e482e486f

SHA1
a9003c333dacc6552949d7962c261841f0ca406c

SHA256
a01dd6978ac4fbc8d75525d99f666ac4320cd8d97b1999c22157e0f282d13b9e

SHA512
2875ef89d213195a740cbf5b8640bc92dceb5cfe86739d2111d324d583a929847f0f8fcd0d4fff84b6959b3cfeedfb769a8680670c3e0bd18c4ec118abd755e8

Download Submit
C:\WINDOWS\zxcvv.vbs

Filesize
266KB

MD5
e54857b4590a2097ae9c67d700aa0366

SHA1
3afeac8582f22e5af9bf8fc6bb45f0c85357dac7

SHA256
79f7d1725133388d18b976f6e2fd89813d57aa6c809939f7c4526cf1e2e312ae

SHA512
04d0aef7adec0d2d7f674fbf577a2295098f06cd1b4e9b311d4f62fb6c5c4e592f7666c01ceefc9677fdde42f6dca4a6e3376152f7d7a7b9e0d77fc49f4f322d

Download Submit
C:\WINDOWS\zxcvv.vbs

Filesize
266KB

MD5
e54857b4590a2097ae9c67d700aa0366

SHA1
3afeac8582f22e5af9bf8fc6bb45f0c85357dac7

SHA256
79f7d1725133388d18b976f6e2fd89813d57aa6c809939f7c4526cf1e2e312ae

SHA512
04d0aef7adec0d2d7f674fbf577a2295098f06cd1b4e9b311d4f62fb6c5c4e592f7666c01ceefc9677fdde42f6dca4a6e3376152f7d7a7b9e0d77fc49f4f322d

Download Submit