8dce833d9f135bc5d381217bd8e7390464bd18032214d8427186db7a505cf5c0

Analysis

max time kernel
168s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 20:04

Target

0fa2c32060eebf4377b7c812bcd06e2c.exe
Size

49KB
MD5

0fa2c32060eebf4377b7c812bcd06e2c
SHA1

77b38d635963bd065fe8f4db5339fe15b47846a7
SHA256

8dce833d9f135bc5d381217bd8e7390464bd18032214d8427186db7a505cf5c0
SHA512

299e8535e591d5ffc7fa22d475f80a383c2d03d3de11ab1b5d34a39890c0754a4de5c0d43ef6cb4ad2eddc15b13426346fbbb371784b667c617c133c9b290f58
SSDEEP

768:mCau1g2Jb8lFDKcQFWGYjcHvYO52OGnuh//HwT0+rYl2SjD943HGWX:mCau1TWflGjAO56e5uHh

Score

7^/10

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	204.117.214.10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe:exe.exe	0fa2c32060eebf4377b7c812bcd06e2c.exe
File created	C:\Windows\SysWOW64\icf.exe	0fa2c32060eebf4377b7c812bcd06e2c.exe
File opened for modification	C:\Windows\SysWOW64\icf.exe	0fa2c32060eebf4377b7c812bcd06e2c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 836	1400	0fa2c32060eebf4377b7c812bcd06e2c.exe	87

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 836	1400	0fa2c32060eebf4377b7c812bcd06e2c.exe	87
PID 1400 wrote to memory of 836	1400	0fa2c32060eebf4377b7c812bcd06e2c.exe	87
PID 1400 wrote to memory of 836	1400	0fa2c32060eebf4377b7c812bcd06e2c.exe	87
PID 1400 wrote to memory of 836	1400	0fa2c32060eebf4377b7c812bcd06e2c.exe	87
PID 1400 wrote to memory of 4320	1400	0fa2c32060eebf4377b7c812bcd06e2c.exe	89
PID 1400 wrote to memory of 4320	1400	0fa2c32060eebf4377b7c812bcd06e2c.exe	89
PID 1400 wrote to memory of 4320	1400	0fa2c32060eebf4377b7c812bcd06e2c.exe	89

C:\Users\Admin\AppData\Local\Temp\0fa2c32060eebf4377b7c812bcd06e2c.exe
"C:\Users\Admin\AppData\Local\Temp\0fa2c32060eebf4377b7c812bcd06e2c.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\4980739.bat
  2⤵
  PID:4320

C:\Users\Admin\AppData\Local\Temp\4980739.bat

Filesize
235B

MD5
779f53e94b3250a6f06a3b156354f393

SHA1
1f806f8d8212b3a78150c8abd47ae53706f4d6a2

SHA256
9e25b60579157d959106337bcb7f94aa6919453f5de3a7d360d559946250cc2f

SHA512
70e7e623269d16cc0cf9470fce3baf646cc7e5e71423705da26922c54dee4cfd5e138f759f67da6438d64bbfd60cfb5d9584515e22bce23ba4d74c96a4f80b41

Download Submit
memory/836-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/836-4-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/836-5-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/836-7-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download