e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-12-2022 15:15

Target

e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf.exe
Size

13KB
MD5

45d39e2138c78701d1761d013f46f1f0
SHA1

032a5b28f5ea7fd199b8f987ef36b8eea7132850
SHA256

e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf
SHA512

7676f806452f269e825d550263daa141e0b5bf3c2f54d05ae4a9ebbd25b9644df1c15732348519cb315a537b7a835b9e5e59aea1776e827b43765e4130710a56
SSDEEP

192:C2WjQTbZ1eBppvfj/j2+cPM3P+Q/tCvwSw3uM76V9bhHOkrUNlC:C2jTbZ0pj/vcqP+ctCYSw3GV9bhrUNl

Score

4^/10

Drops file in Windows directory 2 IoCs

Processes:

e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf.exe
File opened for modification	C:\Windows\Tasks\wow64.job	e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1296 wrote to memory of 1264	1296	taskeng.exe	e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf.exe
PID 1296 wrote to memory of 1264	1296	taskeng.exe	e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf.exe
PID 1296 wrote to memory of 1264	1296	taskeng.exe	e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf.exe
PID 1296 wrote to memory of 1264	1296	taskeng.exe	e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf.exe

C:\Users\Admin\AppData\Local\Temp\e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf.exe
"C:\Users\Admin\AppData\Local\Temp\e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf.exe"
1⤵
- Drops file in Windows directory
PID:872

C:\Windows\system32\taskeng.exe
taskeng.exe {F804796C-82AB-41F1-9188-BC7A55CE4C6B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1296

C:\Users\Admin\AppData\Local\Temp\e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf.exe
C:\Users\Admin\AppData\Local\Temp\e212f2ea33608c96b104f123199f4c3efdcaeca1ae38abc4efb34e65ff5640cf.exe start
2⤵
PID:1264

memory/872-54-0x00000000767C1000-0x00000000767C3000-memory.dmp

Filesize
8KB

Download
memory/1264-55-0x0000000000000000-mapping.dmp

Download