935adef69ad72ef5f068ced105faada5e3d28c7a590010a361cf6bd6a8b4e3c6

Analysis

max time kernel
129s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 06:24

Target

66ec3873279814d992f51a91457e089c.exe
Size

27KB
MD5

66ec3873279814d992f51a91457e089c
SHA1

c03c78b98755a0b5dfebc70c06c382c4caa075b7
SHA256

935adef69ad72ef5f068ced105faada5e3d28c7a590010a361cf6bd6a8b4e3c6
SHA512

7bfe8bd06b326263039b70e72e4a0d8afe98ce478abd6be99e44326979516cbed5c745ebbcc975ead70d3d3f75381a7cde68721dd36c916adcc957107221f3db
SSDEEP

768:L7akyVmeSitYS4l/2zAp+nvmlHC091mrLWQdonbcuyD7U:q4s4lp+nvCi09aWuonouy8

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kr_done1	66ec3873279814d992f51a91457e089c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4348	66ec3873279814d992f51a91457e089c.exe
4348	66ec3873279814d992f51a91457e089c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 2296	4348	66ec3873279814d992f51a91457e089c.exe	92
PID 4348 wrote to memory of 2296	4348	66ec3873279814d992f51a91457e089c.exe	92
PID 4348 wrote to memory of 2296	4348	66ec3873279814d992f51a91457e089c.exe	92

C:\Users\Admin\AppData\Local\Temp\66ec3873279814d992f51a91457e089c.exe
"C:\Users\Admin\AppData\Local\Temp\66ec3873279814d992f51a91457e089c.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninste5755a2.bat" "C:\Users\Admin\AppData\Local\Temp\66ec3873279814d992f51a91457e089c.exe""
  2⤵
  PID:2296

C:\Users\Admin\AppData\Local\Temp\uninste5755a2.bat

Filesize
59B

MD5
2988b921fbed03f9c93c5d538932bbe3

SHA1
4b791b3d59ae76ff091c2cf201b40f5d1b432a3f

SHA256
a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3

SHA512
2920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9

Download Submit
memory/4348-0-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/4348-9-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download