e5b7f9499f355f0ad23141d8d83f9530ab2ba242cc143c9be38b874cf9014532

Analysis

max time kernel
140s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 07:17

Target

5bffb09476a8554c18e1f472fa22f057.exe
Size

50KB
MD5

5bffb09476a8554c18e1f472fa22f057
SHA1

df3a41c44b85c4ab78f86445d43cecc3ecd23400
SHA256

e5b7f9499f355f0ad23141d8d83f9530ab2ba242cc143c9be38b874cf9014532
SHA512

f0b654b7457dab7bfaff6c86b03ee3a12a219c5adb7cfe147b412683e93e117fd81cfca8959763f575bfe79fa3d0c8e7436daf138d61930c8374368d093cfeb7
SSDEEP

1536:dh6TSMB+/re5napiaVAdduxeA5wXuJnC:dh6LKreUcVdieA5w+

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kr_done1	5bffb09476a8554c18e1f472fa22f057.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
976	5bffb09476a8554c18e1f472fa22f057.exe
976	5bffb09476a8554c18e1f472fa22f057.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 3844	976	5bffb09476a8554c18e1f472fa22f057.exe	96
PID 976 wrote to memory of 3844	976	5bffb09476a8554c18e1f472fa22f057.exe	96
PID 976 wrote to memory of 3844	976	5bffb09476a8554c18e1f472fa22f057.exe	96

C:\Users\Admin\AppData\Local\Temp\5bffb09476a8554c18e1f472fa22f057.exe
"C:\Users\Admin\AppData\Local\Temp\5bffb09476a8554c18e1f472fa22f057.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninste581170.bat" "C:\Users\Admin\AppData\Local\Temp\5bffb09476a8554c18e1f472fa22f057.exe""
  2⤵
  PID:3844

C:\Users\Admin\AppData\Local\Temp\uninste581170.bat

Filesize
59B

MD5
2988b921fbed03f9c93c5d538932bbe3

SHA1
4b791b3d59ae76ff091c2cf201b40f5d1b432a3f

SHA256
a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3

SHA512
2920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9

Download Submit
memory/976-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/976-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/976-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download