d47df74ca20cdfd4f3c65381a0d2101cb9a09a15e534b4997dc1c1c178f72ef7

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 10:36

Target

67bda122e840b02c0bfa7d08b0f63faa.exe
Size

77KB
MD5

67bda122e840b02c0bfa7d08b0f63faa
SHA1

1c77f0bb317e1f345b94059f22ad846df4d32c3b
SHA256

d47df74ca20cdfd4f3c65381a0d2101cb9a09a15e534b4997dc1c1c178f72ef7
SHA512

0aa27b3e9ffb284d90f2ac9d34e6729b712f7313ca6422e2579d47674bf4b02e25646190ec2468a3050d9257ec4e746b42d52fd6a8fe8c7ef50cfb4e0896447e
SSDEEP

1536:ZYCVbuQO2zolVUyLl4+QEFsQkoZfQ2ndCAVagPpqf90HpWX:Znunl9/QE+0fQQvPpWUpWX

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3440 set thread context of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Web\wallpaPer.pif	67bda122e840b02c0bfa7d08b0f63faa.exe
File opened for modification	C:\Windows\Web\wallpaPer.pif	67bda122e840b02c0bfa7d08b0f63faa.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22
PID 3440 wrote to memory of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22
PID 3440 wrote to memory of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22
PID 3440 wrote to memory of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22
PID 3440 wrote to memory of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22
PID 3440 wrote to memory of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22
PID 3440 wrote to memory of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22
PID 3440 wrote to memory of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22
PID 3440 wrote to memory of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22
PID 3440 wrote to memory of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22
PID 3440 wrote to memory of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22
PID 3440 wrote to memory of 220	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	22
PID 3440 wrote to memory of 224	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	21
PID 3440 wrote to memory of 224	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	21
PID 3440 wrote to memory of 224	3440	67bda122e840b02c0bfa7d08b0f63faa.exe	21

C:\Users\Admin\AppData\Local\Temp\67bda122e840b02c0bfa7d08b0f63faa.exe
"C:\Users\Admin\AppData\Local\Temp\67bda122e840b02c0bfa7d08b0f63faa.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\67bda122e840b02c0bfa7d08b0f63faa.exe"
  2⤵
  PID:224
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" %1
  2⤵
  PID:220

memory/220-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3440-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download