3e638ccd4baa2b5144ee457b4ee240f91263a9b1395c72e0ad7942b24427fb7c

Analysis

max time kernel
128s
max time network
7s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:00

Target

0af4604df0fd7e19331f98dce24ea765.exe
Size

53KB
MD5

0af4604df0fd7e19331f98dce24ea765
SHA1

88412c41902bc96cb02b15e44b576ec7f9b93076
SHA256

3e638ccd4baa2b5144ee457b4ee240f91263a9b1395c72e0ad7942b24427fb7c
SHA512

aac00b0f643614ddb3ac687b8110a4f958050d274059cadf6742e30dc49129223cb4451033394b45a7e90c2adf194ee427cfb64f5a66539db7868f695918485b
SSDEEP

768:rLp/8oqCLjLlsloNw8LI6T82taM+qdrE/rB6q7h2DJhA:rLp/8lCLjRvLI6T80aMzlOd6Kct

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4908	exp1orer.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\exp1orer.exe	0af4604df0fd7e19331f98dce24ea765.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	0af4604df0fd7e19331f98dce24ea765.exe
File created	C:\Windows\SysWOW64\a.bat	exp1orer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1400	0af4604df0fd7e19331f98dce24ea765.exe
4908	exp1orer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 4908	1400	0af4604df0fd7e19331f98dce24ea765.exe	22
PID 1400 wrote to memory of 4908	1400	0af4604df0fd7e19331f98dce24ea765.exe	22
PID 1400 wrote to memory of 4908	1400	0af4604df0fd7e19331f98dce24ea765.exe	22
PID 4908 wrote to memory of 2204	4908	exp1orer.exe	21
PID 4908 wrote to memory of 2204	4908	exp1orer.exe	21
PID 4908 wrote to memory of 2204	4908	exp1orer.exe	21
PID 1400 wrote to memory of 4680	1400	0af4604df0fd7e19331f98dce24ea765.exe	19
PID 1400 wrote to memory of 4680	1400	0af4604df0fd7e19331f98dce24ea765.exe	19
PID 1400 wrote to memory of 4680	1400	0af4604df0fd7e19331f98dce24ea765.exe	19

C:\Users\Admin\AppData\Local\Temp\0af4604df0fd7e19331f98dce24ea765.exe
"C:\Users\Admin\AppData\Local\Temp\0af4604df0fd7e19331f98dce24ea765.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\a.bat
  2⤵
  PID:4680
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4908

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\a.bat
1⤵
PID:2204

memory/1400-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1400-15-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4908-14-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download