8882c12b22d28a40b7515cc5ce0a453bcdcebd2be9a1247eea50d21d3a11a57f

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 05:51

Target

79710926436a7ede1e1495bcc71481f6.exe
Size

506KB
MD5

79710926436a7ede1e1495bcc71481f6
SHA1

94411ad4f344528fa9082296fe6e68f1f83032ee
SHA256

8882c12b22d28a40b7515cc5ce0a453bcdcebd2be9a1247eea50d21d3a11a57f
SHA512

1a8484526f6cd3e1ddaac2c51965ed671940fbbbbe6133bdbaf6af04e39139976d27910f9f8bfe38105907abdfd8d2084f3f3cae08bd320a607cb25f1b807774
SSDEEP

12288:A0FMsbFh6L7cuVpDQyB8SNQs0uyEDzff:A0qe4HcIcMfH7Dzf

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4484	winsate.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winsate.exe	79710926436a7ede1e1495bcc71481f6.exe
File created	C:\Windows\SysWOW64\winsate.exe	winsate.exe
File opened for modification	C:\Windows\SysWOW64\winsate.exe	winsate.exe
File created	C:\Windows\SysWOW64\winsate.exe	79710926436a7ede1e1495bcc71481f6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1436	4524	79710926436a7ede1e1495bcc71481f6.exe	96
PID 4524 wrote to memory of 1436	4524	79710926436a7ede1e1495bcc71481f6.exe	96
PID 4524 wrote to memory of 1436	4524	79710926436a7ede1e1495bcc71481f6.exe	96

C:\Users\Admin\AppData\Local\Temp\79710926436a7ede1e1495bcc71481f6.exe
"C:\Users\Admin\AppData\Local\Temp\79710926436a7ede1e1495bcc71481f6.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nfnegd.bat
  2⤵
  PID:1436

C:\Users\Admin\AppData\Local\Temp\nfnegd.bat

Filesize
184B

MD5
154328f46e79c7694d2c82ea33f7e872

SHA1
67d99e624b52310bf224931256b0d182b56ec52c

SHA256
33552f28d053e37ab135cc37c5cf21e1061476c13d344ef440adb6263aae0e90

SHA512
00429d580c849e283fbe944035d6e3c2f4ae54efc296387ac938cd60fcffa302b4e148c59000d448ad212e1f253e6a1b5c895e1be75a0f16f282f1d5688ad6b3

Download Submit
C:\Windows\SysWOW64\winsate.exe

Filesize
506KB

MD5
79710926436a7ede1e1495bcc71481f6

SHA1
94411ad4f344528fa9082296fe6e68f1f83032ee

SHA256
8882c12b22d28a40b7515cc5ce0a453bcdcebd2be9a1247eea50d21d3a11a57f

SHA512
1a8484526f6cd3e1ddaac2c51965ed671940fbbbbe6133bdbaf6af04e39139976d27910f9f8bfe38105907abdfd8d2084f3f3cae08bd320a607cb25f1b807774

Download Submit
memory/4484-16-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/4484-18-0x0000000013140000-0x00000000131C5000-memory.dmp

Filesize
532KB

Download
memory/4524-0-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/4524-6-0x00000000022C0000-0x00000000022CB000-memory.dmp

Filesize
44KB

Download
memory/4524-17-0x0000000013140000-0x00000000131C5000-memory.dmp

Filesize
532KB

Download
memory/4524-19-0x0000000013140000-0x00000000131C5000-memory.dmp

Filesize
532KB

Download