105ffaae906c8b8d1d600cb1d79031b4cdc0279f3c2a1669a8c96ce5237537ee

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:48

Target

0396ac3498a67827514b6af2a7463deb.exe
Size

303KB
MD5

0396ac3498a67827514b6af2a7463deb
SHA1

683480edfdf648e36d16142a2fac5a7aaff539e1
SHA256

105ffaae906c8b8d1d600cb1d79031b4cdc0279f3c2a1669a8c96ce5237537ee
SHA512

b852958798c5934a79bb37e98a010234df05e0b3cc58a7f64a3ad5e80fa4414d83d9cc9d4269845c6e633ff38960054adba31ae8524d12dae1296d38f9f2bed5
SSDEEP

6144:3KzIQQ0v82Aa3xGKeP5xHJKzbU2Mp2+cBBYORWFZS+e5H40/x:6zII0a3AKqjIBME5BYZE5H4Gx

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4848	SVCHOSI.EXE

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SVCHOSI.EXE	0396ac3498a67827514b6af2a7463deb.exe
File opened for modification	C:\Windows\SysWOW64\SVCHOSI.EXE	0396ac3498a67827514b6af2a7463deb.exe
File opened for modification	C:\Windows\SysWOW64\SVCHOSI.EXE	SVCHOSI.EXE
File created	C:\Windows\SysWOW64\Deleteme.bat	0396ac3498a67827514b6af2a7463deb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4848	4776	0396ac3498a67827514b6af2a7463deb.exe	91
PID 4776 wrote to memory of 4848	4776	0396ac3498a67827514b6af2a7463deb.exe	91
PID 4776 wrote to memory of 4848	4776	0396ac3498a67827514b6af2a7463deb.exe	91
PID 4776 wrote to memory of 3688	4776	0396ac3498a67827514b6af2a7463deb.exe	92
PID 4776 wrote to memory of 3688	4776	0396ac3498a67827514b6af2a7463deb.exe	92
PID 4776 wrote to memory of 3688	4776	0396ac3498a67827514b6af2a7463deb.exe	92

C:\Users\Admin\AppData\Local\Temp\0396ac3498a67827514b6af2a7463deb.exe
"C:\Users\Admin\AppData\Local\Temp\0396ac3498a67827514b6af2a7463deb.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\SVCHOSI.EXE
  C:\Windows\system32\SVCHOSI.EXE -NETBC
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:4848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  PID:3688

C:\Windows\SysWOW64\Deleteme.bat

Filesize
184B

MD5
1ea4875e2647d0b230119a2e18fc0076

SHA1
1188e831076b1da192d3de91aa92c8928a2d092c

SHA256
ee9a378b9cc35f9e7521b3bda5583e6f5c56ecf659faa74f3657c901d49e81ab

SHA512
02f8ae7b17cf1283c3a966e7cf426afedfb13771893968d7453bc555f5869a4f35be14f888658a8b962f4eb598da4a0c6399ede41b93f2b3ac30115712bb9a6a

Download Submit
C:\Windows\SysWOW64\SVCHOSI.EXE

Filesize
303KB

MD5
0396ac3498a67827514b6af2a7463deb

SHA1
683480edfdf648e36d16142a2fac5a7aaff539e1

SHA256
105ffaae906c8b8d1d600cb1d79031b4cdc0279f3c2a1669a8c96ce5237537ee

SHA512
b852958798c5934a79bb37e98a010234df05e0b3cc58a7f64a3ad5e80fa4414d83d9cc9d4269845c6e633ff38960054adba31ae8524d12dae1296d38f9f2bed5

Download Submit
memory/4776-0-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4776-2-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4776-1-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/4776-6-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/4776-17-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4848-12-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4848-13-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/4848-16-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download