e390281ac1383e5473bab2332c99bb7e81f05a6b070184f46bc33e5278cca9d3

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 10:39

Target

0a2e1bed44ac00bb2d77c0da11d45f50.exe
Size

50KB
MD5

0a2e1bed44ac00bb2d77c0da11d45f50
SHA1

d77813240148e662d059e26d9b7bd48abbdb0abe
SHA256

e390281ac1383e5473bab2332c99bb7e81f05a6b070184f46bc33e5278cca9d3
SHA512

b10a5939d6d4cdef9dbf467861ebf1e0e7c6a2f41f4aeafe3f18c1c3f1b4d7f4e62cbd834b768d0ba8c313a446c7e015f1f837012e8b4c57031f052dbc1422b6
SSDEEP

768:CPWzpXo5ADipLi643AkFxjVYp/PDZfB0iC+k8gi/zrFTqBJ77G0KLJ1H:miXoGDixl43Led50Sn/zsr3G/H

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	0a2e1bed44ac00bb2d77c0da11d45f50.exe
File opened for modification	C:\Windows\WindowsUpdate.log	wuapp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1264	2436	0a2e1bed44ac00bb2d77c0da11d45f50.exe	28
PID 2436 wrote to memory of 1264	2436	0a2e1bed44ac00bb2d77c0da11d45f50.exe	28
PID 2436 wrote to memory of 1264	2436	0a2e1bed44ac00bb2d77c0da11d45f50.exe	28
PID 2436 wrote to memory of 1264	2436	0a2e1bed44ac00bb2d77c0da11d45f50.exe	28

C:\Users\Admin\AppData\Local\Temp\0a2e1bed44ac00bb2d77c0da11d45f50.exe
"C:\Users\Admin\AppData\Local\Temp\0a2e1bed44ac00bb2d77c0da11d45f50.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\system32\wuapp.exe
  "C:\Windows\system32\wuapp.exe"
  2⤵
  - Drops file in Windows directory
  PID:1264

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2672

memory/2436-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2436-1-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download