a21a3a6aef43675e8ec5cb5e47bbd9556fbc702abc08d1ecd12f9adba4b373f8

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 06:08

Target

0a7b2e346babef948afe9eec15f7b09c.exe
Size

46KB
MD5

0a7b2e346babef948afe9eec15f7b09c
SHA1

28d4244ccbc7f4c1bfbea9c4ba6bbbf1023b11f5
SHA256

a21a3a6aef43675e8ec5cb5e47bbd9556fbc702abc08d1ecd12f9adba4b373f8
SHA512

e015dea90a8f444e4c39fb16c53e23bddf816be7398023f391c6563df5b5aa3b622cb3c16a79289e250a2365fd1acf6835ee5d02db37cf81aa93a32b041f45df
SSDEEP

768:XpRJwG22YwuU3f83UdfzfnBA5VIwEZzfRqHGvkx6WtX+EpcrN2iq9/NW5:XpR82L3fOofnBaEZbQCWzcrQ5VW5

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1376	0a7b2e346babef948afe9eec15f7b09c.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\0a7b2e346babef948afe9eec15f7b09c.exe	0a7b2e346babef948afe9eec15f7b09c.exe
File opened for modification	C:\Windows\0a7b2e346babef948afe9eec15f7b09c.exe	0a7b2e346babef948afe9eec15f7b09c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1376	4376	0a7b2e346babef948afe9eec15f7b09c.exe	17
PID 4376 wrote to memory of 1376	4376	0a7b2e346babef948afe9eec15f7b09c.exe	17
PID 4376 wrote to memory of 1376	4376	0a7b2e346babef948afe9eec15f7b09c.exe	17

C:\Users\Admin\AppData\Local\Temp\0a7b2e346babef948afe9eec15f7b09c.exe
"C:\Users\Admin\AppData\Local\Temp\0a7b2e346babef948afe9eec15f7b09c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\0a7b2e346babef948afe9eec15f7b09c.exe
  C:\Windows\0a7b2e346babef948afe9eec15f7b09c.exe "C:\Users\Admin\AppData\Local\Temp\0a7b2e346babef948afe9eec15f7b09c.exe"
  2⤵
  - Executes dropped EXE
  PID:1376

C:\Windows\0a7b2e346babef948afe9eec15f7b09c.exe

Filesize
46KB

MD5
0a7b2e346babef948afe9eec15f7b09c

SHA1
28d4244ccbc7f4c1bfbea9c4ba6bbbf1023b11f5

SHA256
a21a3a6aef43675e8ec5cb5e47bbd9556fbc702abc08d1ecd12f9adba4b373f8

SHA512
e015dea90a8f444e4c39fb16c53e23bddf816be7398023f391c6563df5b5aa3b622cb3c16a79289e250a2365fd1acf6835ee5d02db37cf81aa93a32b041f45df

Download Submit
memory/1376-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4376-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download