3e5980b1eb258d8dd831335693a99b77eb7f0a59298cf79c4726a175da010f24

Analysis

max time kernel
0s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:44

Target

0a854cf0fd9f2a188f87fb1849b2a616.exe
Size

14KB
MD5

0a854cf0fd9f2a188f87fb1849b2a616
SHA1

36d8c472e1b40b36663ec271805ceb0cd67196c3
SHA256

3e5980b1eb258d8dd831335693a99b77eb7f0a59298cf79c4726a175da010f24
SHA512

c4d2fe694345ff0effeff023803b25c272ceda55949c729a4f2d363616cb82dd7f4c218d81e07ff5a781e4357602b16cac83da4455b929b4931d781d29617853
SSDEEP

192:UKolLDIGpeXSjvnS8KcTmhiXsN9R+aVexqpvoGTUISWIOoMjqujMzk7HOpE/tw:U3VZgXSjvS8FTbsNySV9zTBroe2kLJt

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3552	mdmdll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mdmdll32.exe	0a854cf0fd9f2a188f87fb1849b2a616.exe
File created	C:\Windows\SysWOW64\mdmdll32.exe	0a854cf0fd9f2a188f87fb1849b2a616.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 3552	2744	0a854cf0fd9f2a188f87fb1849b2a616.exe	21
PID 2744 wrote to memory of 3552	2744	0a854cf0fd9f2a188f87fb1849b2a616.exe	21
PID 2744 wrote to memory of 3552	2744	0a854cf0fd9f2a188f87fb1849b2a616.exe	21

C:\Users\Admin\AppData\Local\Temp\0a854cf0fd9f2a188f87fb1849b2a616.exe
"C:\Users\Admin\AppData\Local\Temp\0a854cf0fd9f2a188f87fb1849b2a616.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\mdmdll32.exe
  C:\Windows\system32\mdmdll32.exe 5EA1355FD8066C91 c:\users\admin\appdata\local\temp\0a854cf0fd9f2a188f87fb1849b2a616.exe
  2⤵
  - Executes dropped EXE
  PID:3552

memory/2744-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2744-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2744-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3552-12-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3552-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download