9f68f42e1d73a2c01282f85f4fd2dc88efa3ea5c3b86e19a134ccbbcc7afb536

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-03-2023 08:22

Target

632a0af14d18fc2fefa2d7cd110b0068.exe
Size

13KB
MD5

632a0af14d18fc2fefa2d7cd110b0068
SHA1

b38adc8bb6ad4ce5f50a0880c86eddb82e096eed
SHA256

9f68f42e1d73a2c01282f85f4fd2dc88efa3ea5c3b86e19a134ccbbcc7afb536
SHA512

1574a8c5723bc5e32fb5d175a75e66ff6d6972e86a95aca58107609e444b052997f27a4d3f3a23ae85dc3f5c1962b926574e6b6dad398f7b6e17d25aed518165
SSDEEP

192:C2WjQTbZ1eBppvfj/j2+cPM3P+Q/tCvwSw3uM76V9bdOkrUN:C2jTbZ0pj/vcqP+ctCYSw3GV9btrUN

Score

4^/10

Drops file in Windows directory 2 IoCs

Processes:

632a0af14d18fc2fefa2d7cd110b0068.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	632a0af14d18fc2fefa2d7cd110b0068.exe
File opened for modification	C:\Windows\Tasks\wow64.job	632a0af14d18fc2fefa2d7cd110b0068.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1636 wrote to memory of 836	1636	taskeng.exe	632a0af14d18fc2fefa2d7cd110b0068.exe
PID 1636 wrote to memory of 836	1636	taskeng.exe	632a0af14d18fc2fefa2d7cd110b0068.exe
PID 1636 wrote to memory of 836	1636	taskeng.exe	632a0af14d18fc2fefa2d7cd110b0068.exe
PID 1636 wrote to memory of 836	1636	taskeng.exe	632a0af14d18fc2fefa2d7cd110b0068.exe

C:\Users\Admin\AppData\Local\Temp\632a0af14d18fc2fefa2d7cd110b0068.exe
"C:\Users\Admin\AppData\Local\Temp\632a0af14d18fc2fefa2d7cd110b0068.exe"
1⤵
- Drops file in Windows directory
PID:1432

C:\Windows\system32\taskeng.exe
taskeng.exe {C40F7EC2-316C-42C0-9ED2-C62CCA35F16B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Users\Admin\AppData\Local\Temp\632a0af14d18fc2fefa2d7cd110b0068.exe
C:\Users\Admin\AppData\Local\Temp\632a0af14d18fc2fefa2d7cd110b0068.exe start
2⤵
PID:836