eac8ee89b15afe2b1e582682c73f15bfe8deba229347a529cb11d8bc051ff4a1

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:36

Target

00a53e07cd6ff433f3eec2c438120ff3.exe
Size

32KB
MD5

00a53e07cd6ff433f3eec2c438120ff3
SHA1

1a47525765671dfc670f34589dfed3a6fbdc88c6
SHA256

eac8ee89b15afe2b1e582682c73f15bfe8deba229347a529cb11d8bc051ff4a1
SHA512

6d4e537153ef15a5006d0d7029893d616d52c29bc8ad19b795effe96790178c4a8d84c9947bf99df2a828ffedfcf0324e97651b4b742978603ce0be3e2c8a6c1
SSDEEP

384:+nweSRutEUsTmPqbrVBS7Bx28aIIrskQCdRiMNuQZwGfrh3VKvTvXk69YwElDnXf:+wMEaPqFBcdJIrKQZJb+TkRZXp78UQBk

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\server.exe	00a53e07cd6ff433f3eec2c438120ff3.exe
File opened for modification	C:\Windows\SysWOW64\server.exe	00a53e07cd6ff433f3eec2c438120ff3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1304	2108	00a53e07cd6ff433f3eec2c438120ff3.exe	28
PID 2108 wrote to memory of 1304	2108	00a53e07cd6ff433f3eec2c438120ff3.exe	28
PID 2108 wrote to memory of 1304	2108	00a53e07cd6ff433f3eec2c438120ff3.exe	28
PID 2108 wrote to memory of 1304	2108	00a53e07cd6ff433f3eec2c438120ff3.exe	28

C:\Users\Admin\AppData\Local\Temp\00a53e07cd6ff433f3eec2c438120ff3.exe
"C:\Users\Admin\AppData\Local\Temp\00a53e07cd6ff433f3eec2c438120ff3.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files\Internet Explorer\iexplore.exe
  C:\Windows\system32\server.exe
  2⤵
  PID:1304

memory/2108-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download