4caf01ecb8dd5e3c68a9ce93196a4ed74b6e7c843ff56707ef8f7c84afcb5d05

Analysis

max time kernel
146s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:31

Target

381ff45f6cda9454dbfb1af003f0be86.exe
Size

249KB
MD5

381ff45f6cda9454dbfb1af003f0be86
SHA1

0fde1b733fb98ea1c2450f745cc6e6f3f460c3ca
SHA256

4caf01ecb8dd5e3c68a9ce93196a4ed74b6e7c843ff56707ef8f7c84afcb5d05
SHA512

05716acc769f00b3dda4a736d65e07d5e22fb72fff06183a323325d9571345931a967fbd0a4d52644f9fb37b27f43cd7ad5b0c141e20b8fdab37388cb1f4e971
SSDEEP

6144:QZQI7dkQqHNbbc/8Zz9DRAQW+Y7zk4NU9L/b:QZQIaptM/8J9qbI9L/b

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4680	Windows Aues

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Delete.bat	381ff45f6cda9454dbfb1af003f0be86.exe
File created	C:\Windows\Windows Aues	381ff45f6cda9454dbfb1af003f0be86.exe
File opened for modification	C:\Windows\Windows Aues	381ff45f6cda9454dbfb1af003f0be86.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4680	Windows Aues

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4688	4748	381ff45f6cda9454dbfb1af003f0be86.exe	38
PID 4748 wrote to memory of 4688	4748	381ff45f6cda9454dbfb1af003f0be86.exe	38
PID 4748 wrote to memory of 4688	4748	381ff45f6cda9454dbfb1af003f0be86.exe	38
PID 4680 wrote to memory of 4496	4680	Windows Aues	39
PID 4680 wrote to memory of 4496	4680	Windows Aues	39

C:\Users\Admin\AppData\Local\Temp\381ff45f6cda9454dbfb1af003f0be86.exe
"C:\Users\Admin\AppData\Local\Temp\381ff45f6cda9454dbfb1af003f0be86.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Delete.bat
  2⤵
  PID:4688

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
1⤵
PID:4496

memory/4680-11-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/4680-7-0x00000000007D0000-0x00000000007D2000-memory.dmp

Filesize
8KB

Download
memory/4680-13-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/4680-14-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/4680-16-0x00000000007D0000-0x00000000007D2000-memory.dmp

Filesize
8KB

Download
memory/4680-17-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/4748-1-0x00000000007D0000-0x00000000007D2000-memory.dmp

Filesize
8KB

Download
memory/4748-2-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/4748-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/4748-10-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download