cf27e8aa2c0fe832aa3066f6b7a751480b7ebb93e39e09c1f751bb83c08b5e4b

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:13

Target

182a951ffd94d139354c18d4cf52e0f1.exe
Size

67KB
MD5

182a951ffd94d139354c18d4cf52e0f1
SHA1

eb1e17c466a0356d09db723e71f499e3115682db
SHA256

cf27e8aa2c0fe832aa3066f6b7a751480b7ebb93e39e09c1f751bb83c08b5e4b
SHA512

5292cf7c3ab8638b645ce705f0b7ff4e9c6b251d1a2998ccb655ca0cf70ccce1fb9274e5cafab654afc120b543dd7cf2fb13657ca40a0a42460f56977e1eb823
SSDEEP

1536:p2OqcJgMzaymwRCcTzh7IENYXMQbvDdlk8jcVBh:pBqcJHvhCAx5cvTbgh

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
4448	182a951ffd94d139354c18d4cf52e0f1.exe
4448	182a951ffd94d139354c18d4cf52e0f1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ro.dll	182a951ffd94d139354c18d4cf52e0f1.exe
File created	C:\Windows\SysWOW64\ro.dll	182a951ffd94d139354c18d4cf52e0f1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2968	4448	182a951ffd94d139354c18d4cf52e0f1.exe	88
PID 4448 wrote to memory of 2968	4448	182a951ffd94d139354c18d4cf52e0f1.exe	88
PID 4448 wrote to memory of 2968	4448	182a951ffd94d139354c18d4cf52e0f1.exe	88

C:\Users\Admin\AppData\Local\Temp\182a951ffd94d139354c18d4cf52e0f1.exe
"C:\Users\Admin\AppData\Local\Temp\182a951ffd94d139354c18d4cf52e0f1.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  PID:2968

C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
228B

MD5
17c18c5f20f4993a57aea6b9d007e5d2

SHA1
f9da9e3c05d954b71c889f605dc3f3d3b396250b

SHA256
58216dffb73cbe8383abe87ce3c84845057a8bcdff3e7a09f9d5fccfcc84e159

SHA512
86cc01ee5ad52dd26d233b878ab73459e51f49ef1785e7d01335599ba695efe139de41c2479458c5dcde28e2050c799f5d85dd88e31249fb62862dc4f3a51392

Download Submit
C:\Windows\SysWOW64\ro.dll

Filesize
126KB

MD5
50e20286e703a00fe83913424ea003c5

SHA1
0a73a655020469656248d6246694a8936db3f926

SHA256
e1cbfb839289ec19e643c8093aeb253c96ba9d1ece47adf69cc7c06410640acf

SHA512
5bcb07665a47d441ab61e764e0b7b732b448f983cc4a6972b51decb75e8bf9c3f90cdc70e1e78e04edc0a151a0d645ffd95ac5bdaf4dc5b497f570be271b1851

Download Submit
memory/4448-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4448-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4448-2-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/4448-8-0x00000000022A0000-0x00000000022C5000-memory.dmp

Filesize
148KB

Download
memory/4448-12-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download