6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 14:58

Target

6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19.exe
Size

100KB
MD5

86134e6029ca8ef5671ddd6611b8c554
SHA1

045007b8b8c25bf082b1026fca6a95196d4432c9
SHA256

6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19
SHA512

29ae3afed735143bd66e87f5cd36b964c38541191e1761feaeff16488225ce2e14b6e307bb1d31563bbdd7fd10b405e4ed22185f19e00dc8dea51f3d0f2d8923
SSDEEP

768:W7nkhCphZkSwprRN8tdhin4ak/4LojJRisR5bGJEY8ogXKCC6FQxBDGO+T5/Qcw9:+pbQrTCaU4miBEZoa8y4BgucZu

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
5088	smss.exe
564	smss.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\smss.exe	6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19.exe
File created	C:\Windows\system\smss.exe	6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4948	4256	6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19.exe	87
PID 4256 wrote to memory of 4948	4256	6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19.exe	87
PID 4256 wrote to memory of 4948	4256	6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19.exe	87
PID 4948 wrote to memory of 5088	4948	cmd.exe	89
PID 4948 wrote to memory of 5088	4948	cmd.exe	89
PID 4948 wrote to memory of 5088	4948	cmd.exe	89

C:\Windows\system\smss.exe
C:\Windows\system\smss.exe
1⤵
- Executes dropped EXE
PID:564

C:\Windows\System\smss.exe

Filesize
100KB

MD5
86134e6029ca8ef5671ddd6611b8c554

SHA1
045007b8b8c25bf082b1026fca6a95196d4432c9

SHA256
6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19

SHA512
29ae3afed735143bd66e87f5cd36b964c38541191e1761feaeff16488225ce2e14b6e307bb1d31563bbdd7fd10b405e4ed22185f19e00dc8dea51f3d0f2d8923

Download Submit
memory/564-18-0x0000000014000000-0x0000000014020000-memory.dmp

Filesize
128KB

Download
memory/4256-0-0x0000000014000000-0x0000000014020000-memory.dmp

Filesize
128KB

Download
memory/4256-12-0x0000000014000000-0x0000000014020000-memory.dmp

Filesize
128KB

Download
memory/5088-17-0x0000000014000000-0x0000000014020000-memory.dmp

Filesize
128KB

Download