c6fc7c16d9c9dd355c59b1f3086fe790baad33c6be52881dfc21a9c049754920

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 20:35

Target

1147ceb14c198cacf0458fdfde2d4dd3.exe
Size

139KB
MD5

1147ceb14c198cacf0458fdfde2d4dd3
SHA1

23851f9ea5adc58a80145cc9183ddaedba23c28b
SHA256

c6fc7c16d9c9dd355c59b1f3086fe790baad33c6be52881dfc21a9c049754920
SHA512

6d7e8f8ca54ce5f435ba1098df48a42a343e8b0d9140894c787343e281c2df974b9698082c9ade84c0130fa078ac368c64465cb64c10406e4c2033ecad5cd648
SSDEEP

3072:RlB+fOqTNO/6GwCuDAUyJLywt7mmjlowz7TBfVlyOKWfTzW:Rlk2Ug3t1mmjb7TBtlyOKWfTS

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\clean10fb-298f.sys	1147ceb14c198cacf0458fdfde2d4dd3.exe
File created	C:\Windows\SysWOW64\clean.config	1147ceb14c198cacf0458fdfde2d4dd3.exe
File opened for modification	C:\Windows\SysWOW64\clean.config	1147ceb14c198cacf0458fdfde2d4dd3.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

C:\Users\Admin\AppData\Local\Temp\1147ceb14c198cacf0458fdfde2d4dd3.exe
"C:\Users\Admin\AppData\Local\Temp\1147ceb14c198cacf0458fdfde2d4dd3.exe"
1⤵
- Drops file in System32 directory
PID:1940

C:\Windows\SysWOW64\clean.config

Filesize
10KB

MD5
7479ec933c23dcfa4944458a1205fb28

SHA1
af179c776108f630004580cf5cabc06594fe3c6e

SHA256
de04ac978f58264e85140b14ba9798af4beccdcf96e9aa449d588b4282e122c5

SHA512
c93b8e56e0bc1dee64e06883faa4bed3b043df6aaed053a65ac18798714f8a6befce84c3e9650caf8661e35292f1c7a1341ba091ee84488331fc694d67ea1c8f

Download Submit