be388e4a933b15860be3012fe88a4cd0511adde85f7b3541af549316b62feacd

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:03

Target

0517aab7a1ab0f70c220e89ef692ca46.exe
Size

314KB
MD5

0517aab7a1ab0f70c220e89ef692ca46
SHA1

92c6798c75f0cbaa275fa98c5e15745bd7227af0
SHA256

be388e4a933b15860be3012fe88a4cd0511adde85f7b3541af549316b62feacd
SHA512

04c2b8d5fb442d264e87e79eb535520a548f6d6a4f233061633dbc88ea9dc774adadc23a65805dd2d7c2ce7f87b60fd6a37d2e7e958e80996102df9c5995ce3f
SSDEEP

6144:eM1pcGTgYA2soLUyRfLIDvLHFyKtJQyslIiSHCwg21j:eOczin/l2v7FttKIAkj

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Deleteme.bat	0517aab7a1ab0f70c220e89ef692ca46.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\Connection Wizard\SVCHOSI.EXE	0517aab7a1ab0f70c220e89ef692ca46.exe
File opened for modification	C:\Program Files\Internet Explorer\Connection Wizard\SVCHOSI.EXE	0517aab7a1ab0f70c220e89ef692ca46.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 4520	3824	0517aab7a1ab0f70c220e89ef692ca46.exe	92
PID 3824 wrote to memory of 4520	3824	0517aab7a1ab0f70c220e89ef692ca46.exe	92
PID 3824 wrote to memory of 4520	3824	0517aab7a1ab0f70c220e89ef692ca46.exe	92

C:\Users\Admin\AppData\Local\Temp\0517aab7a1ab0f70c220e89ef692ca46.exe
"C:\Users\Admin\AppData\Local\Temp\0517aab7a1ab0f70c220e89ef692ca46.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  PID:4520

C:\Windows\SysWOW64\Deleteme.bat

Filesize
184B

MD5
f03d1a7e8b0043d2ba9853af0a88d0e1

SHA1
a8759bfd79867713b42f01e6dd28772dc1b5eb96

SHA256
0373d891741c6cab67037a9a106c5e853f677b7635a5791cfed3ada5724edaf2

SHA512
8fe8baf559ee27f68239223c8edfe721417c4ebb2539d4a0636ce5b46d557412b55b926efc39861a39854c16ea0ac6225a30481de1ff1a9cddd6f7bdd71ec157

Download Submit
memory/3824-0-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3824-3-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/3824-2-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3824-1-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/3824-6-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download