bdb613ee7b492b7ab8432e05e5fcbd3cfacc9cb308c3bf3f55c8e45dbe6922b1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:18

Target

3adc72a7f46663b278be509ae047b490.exe
Size

44KB
MD5

3adc72a7f46663b278be509ae047b490
SHA1

20ab2c0cfde8fb9c31b14e1bd07251ce65fb7d20
SHA256

bdb613ee7b492b7ab8432e05e5fcbd3cfacc9cb308c3bf3f55c8e45dbe6922b1
SHA512

4399d3492c6e8bef118755279a9a55ecf4ded30d58c18429ea494cf0d60f30b610af80b9dec7019684ea89ee6cf75d718a618e9fd792c58fe21a3f75eb173cdd
SSDEEP

384:IIhWwLhIhF42mkcCG1SLl1CLk7A2a/NXJYrMKzpfJSqmNSH83wu2J9t:XWSmhF42mkS8L7CLIM1XEnzpxbmzATJ

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1612	2012	3adc72a7f46663b278be509ae047b490.exe	28
PID 2012 wrote to memory of 1612	2012	3adc72a7f46663b278be509ae047b490.exe	28
PID 2012 wrote to memory of 1612	2012	3adc72a7f46663b278be509ae047b490.exe	28
PID 2012 wrote to memory of 1612	2012	3adc72a7f46663b278be509ae047b490.exe	28

C:\Users\Admin\AppData\Local\Temp\3adc72a7f46663b278be509ae047b490.exe
"C:\Users\Admin\AppData\Local\Temp\3adc72a7f46663b278be509ae047b490.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\3adc72a7f46663b278be509ae047b490.exe
  C:\Users\Admin\AppData\Local\Temp\3adc72a7f46663b278be509ae047b490.exe run
  2⤵
  PID:1612

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact