be388e4a933b15860be3012fe88a4cd0511adde85f7b3541af549316b62feacd

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:03

Target

0517aab7a1ab0f70c220e89ef692ca46.exe
Size

314KB
MD5

0517aab7a1ab0f70c220e89ef692ca46
SHA1

92c6798c75f0cbaa275fa98c5e15745bd7227af0
SHA256

be388e4a933b15860be3012fe88a4cd0511adde85f7b3541af549316b62feacd
SHA512

04c2b8d5fb442d264e87e79eb535520a548f6d6a4f233061633dbc88ea9dc774adadc23a65805dd2d7c2ce7f87b60fd6a37d2e7e958e80996102df9c5995ce3f
SSDEEP

6144:eM1pcGTgYA2soLUyRfLIDvLHFyKtJQyslIiSHCwg21j:eOczin/l2v7FttKIAkj

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1280	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Deleteme.bat	0517aab7a1ab0f70c220e89ef692ca46.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\Connection Wizard\SVCHOSI.EXE	0517aab7a1ab0f70c220e89ef692ca46.exe
File opened for modification	C:\Program Files\Internet Explorer\Connection Wizard\SVCHOSI.EXE	0517aab7a1ab0f70c220e89ef692ca46.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1280	2636	0517aab7a1ab0f70c220e89ef692ca46.exe	29
PID 2636 wrote to memory of 1280	2636	0517aab7a1ab0f70c220e89ef692ca46.exe	29
PID 2636 wrote to memory of 1280	2636	0517aab7a1ab0f70c220e89ef692ca46.exe	29
PID 2636 wrote to memory of 1280	2636	0517aab7a1ab0f70c220e89ef692ca46.exe	29

C:\Users\Admin\AppData\Local\Temp\0517aab7a1ab0f70c220e89ef692ca46.exe
"C:\Users\Admin\AppData\Local\Temp\0517aab7a1ab0f70c220e89ef692ca46.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\Deleteme.bat
  2⤵
  - Deletes itself
  PID:1280

memory/2636-1-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2636-3-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2636-2-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2636-0-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2636-11-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download