e128daf9c41b31e60d7f35ae9f60c2936a0a679438b6c8714de62b28ffd4946a

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 04:38

Target

287bd8820136b9257b4e8da6ec3c1048.exe
Size

23KB
MD5

287bd8820136b9257b4e8da6ec3c1048
SHA1

e1ed3319f4524f60eeb5885eff694ad4b5204cb4
SHA256

e128daf9c41b31e60d7f35ae9f60c2936a0a679438b6c8714de62b28ffd4946a
SHA512

3ce2ccfb3e1d10fe0541bc83e4ffdcdada1869ac9a2bd1a4bbe28e2ab2db6e324b55443232302fc63e738586e67c865fe17d8d59ff1d1f18256020664e444232
SSDEEP

384:T25T8jkb1QsMEQMKuy6dZjTnthCUCkDNMwzmkDfE3AbDjME0xEJKWP:y5Qjkb1QCH3jLthC8awiFuD1SEJKWP

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SVCH0ST.EXE	287bd8820136b9257b4e8da6ec3c1048.exe
File opened for modification	C:\Windows\SysWOW64\SVCH0ST.EXE	287bd8820136b9257b4e8da6ec3c1048.exe
File created	C:\Windows\SysWOW64\dll.dll	287bd8820136b9257b4e8da6ec3c1048.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 552	3868	287bd8820136b9257b4e8da6ec3c1048.exe	34
PID 3868 wrote to memory of 552	3868	287bd8820136b9257b4e8da6ec3c1048.exe	34
PID 3868 wrote to memory of 552	3868	287bd8820136b9257b4e8da6ec3c1048.exe	34

C:\Users\Admin\AppData\Local\Temp\287bd8820136b9257b4e8da6ec3c1048.exe
"C:\Users\Admin\AppData\Local\Temp\287bd8820136b9257b4e8da6ec3c1048.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:552

memory/3868-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3868-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3868-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3868-5-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download