ab971c45e2e31f860ac74d476aee2aeb850a5f4130ca12c6c8110e8c4621aca9

Resubmissions

17-12-2022 15:26

31-08-2022 08:41

max time kernel
61s
max time network
142s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-12-2022 15:26

Target

89cb56d6ad669a38a4b234508dbaf512.exe
Size

13KB
MD5

89cb56d6ad669a38a4b234508dbaf512
SHA1

e2e7d4a326c0d8c2cf0cd419d7be98832c839f26
SHA256

ab971c45e2e31f860ac74d476aee2aeb850a5f4130ca12c6c8110e8c4621aca9
SHA512

3d70f41b5fd830be9dda88d3484cb68a42f70e736e5f1ebc6b98303c1f67308a00a9df6b04b647b59e1593a0d4f2c87410c1b4940efa363bbc936693115a8c5c
SSDEEP

192:6kWjQTlZ1eB+pvdNtj2+SPwHP+Q/ZCv2qwvuCKK76n9bJHOkrUN+k:6kjTlZ02NtvSKP+cZC+qwZPGn9bJrUN

Score

4^/10

Drops file in Windows directory 2 IoCs

Processes:

89cb56d6ad669a38a4b234508dbaf512.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	89cb56d6ad669a38a4b234508dbaf512.exe
File opened for modification	C:\Windows\Tasks\wow64.job	89cb56d6ad669a38a4b234508dbaf512.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1676 wrote to memory of 1028	1676	taskeng.exe	89cb56d6ad669a38a4b234508dbaf512.exe
PID 1676 wrote to memory of 1028	1676	taskeng.exe	89cb56d6ad669a38a4b234508dbaf512.exe
PID 1676 wrote to memory of 1028	1676	taskeng.exe	89cb56d6ad669a38a4b234508dbaf512.exe
PID 1676 wrote to memory of 1028	1676	taskeng.exe	89cb56d6ad669a38a4b234508dbaf512.exe

C:\Users\Admin\AppData\Local\Temp\89cb56d6ad669a38a4b234508dbaf512.exe
"C:\Users\Admin\AppData\Local\Temp\89cb56d6ad669a38a4b234508dbaf512.exe"
1⤵
- Drops file in Windows directory
PID:1108

C:\Windows\system32\taskeng.exe
taskeng.exe {8A0EBF7D-1365-48D3-BA0C-59862096658B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Local\Temp\89cb56d6ad669a38a4b234508dbaf512.exe
C:\Users\Admin\AppData\Local\Temp\89cb56d6ad669a38a4b234508dbaf512.exe start
2⤵
PID:1028

memory/1028-55-0x0000000000000000-mapping.dmp

Download
memory/1108-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download