3aef7090f5ad1c6598f487a95495f9afb5d18a0a44b8d9c24b3ba9cd1283c024

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:34

Target

01e3aa1edf99ab0641203a642c085094.exe
Size

185KB
MD5

01e3aa1edf99ab0641203a642c085094
SHA1

f751691af376f20892925929681b0de9ec74cf6a
SHA256

3aef7090f5ad1c6598f487a95495f9afb5d18a0a44b8d9c24b3ba9cd1283c024
SHA512

56695dffa546581f87bcae68bd6d95097c8c14bb3b32ba1bdad88cc334e1592bece3085b4c0dbf59808b764b2d188240a6a436ebc64021d98012b1695e0ded01
SSDEEP

3072:j0O213JYdP8tWiSL54Kl2Qsc0+HzsY/XwY/k/kK7TBf4iVhbym1JUJSx:jfpP8tyL5/vscZzsYvl/kj7TBQijbEJS

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2920	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dhcp Server.exe	01e3aa1edf99ab0641203a642c085094.exe
File created	C:\Windows\SysWOW64\Dhcp Server.exe	01e3aa1edf99ab0641203a642c085094.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3052	01e3aa1edf99ab0641203a642c085094.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2920	3052	01e3aa1edf99ab0641203a642c085094.exe	27
PID 3052 wrote to memory of 2920	3052	01e3aa1edf99ab0641203a642c085094.exe	27
PID 3052 wrote to memory of 2920	3052	01e3aa1edf99ab0641203a642c085094.exe	27
PID 3052 wrote to memory of 2920	3052	01e3aa1edf99ab0641203a642c085094.exe	27

C:\Users\Admin\AppData\Local\Temp\01e3aa1edf99ab0641203a642c085094.exe
"C:\Users\Admin\AppData\Local\Temp\01e3aa1edf99ab0641203a642c085094.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$a25392$$.bat
  2⤵
  - Deletes itself
  PID:2920

C:\Users\Admin\AppData\Local\Temp\$$a25392$$.bat

Filesize
152B

MD5
ed2f3eb43029538e2f302b5fe3ef125e

SHA1
306c09c8a86d34471590c53ea4559025cdc69c75

SHA256
142d6b5f4a38aecaa54428bdc154d6059cd9f6a7171047bbce032cd1ddd59b2f

SHA512
92d328f67d75c06790f7cfaac3ab1f1b3beee736f7ee73670bc2f9ec2ffedbd2e025839362e7a6469d617ef670f820991e5ae7d21fb87bbf82bf2215f5b80e16

Download Submit
memory/3052-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/3052-9-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download