f8c85581e4242eaf3fe23f504184ec7c9b7d8d886ddc7bbb10cb5e59097a6f62

Analysis

max time kernel
154s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 19:10

Target

d6e5da17621df4cbc27e66ebe62babb4.exe
Size

21KB
MD5

d6e5da17621df4cbc27e66ebe62babb4
SHA1

ac65f90fef28ce0fa06a56cda9f09d0c35794722
SHA256

f8c85581e4242eaf3fe23f504184ec7c9b7d8d886ddc7bbb10cb5e59097a6f62
SHA512

fd41152ac35f9c6e375da2519425405028a2b28cbac071fb07fb73d844add9eb3352d648b30125df98f2b7d8cbfda7ca5ce6772530f9c618782d8c217ab5d198
SSDEEP

384:aq0e2vDOHGybyrSx4PFCGinfaU1HpliafpxGbNOaBM1etYl6qP6353B:Ce2CXyrSzfJlLfpcROaq1etYMKsB

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4584	kncer32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kncer32.exe	d6e5da17621df4cbc27e66ebe62babb4.exe
File created	C:\Windows\SysWOW64\kncer32.exe	d6e5da17621df4cbc27e66ebe62babb4.exe
File created	C:\Windows\SysWOW64\kncer32.ini	d6e5da17621df4cbc27e66ebe62babb4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4584	212	d6e5da17621df4cbc27e66ebe62babb4.exe	98
PID 212 wrote to memory of 4584	212	d6e5da17621df4cbc27e66ebe62babb4.exe	98
PID 212 wrote to memory of 4584	212	d6e5da17621df4cbc27e66ebe62babb4.exe	98

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4324

C:\Windows\SysWOW64\kncer32.exe

Filesize
21KB

MD5
d6e5da17621df4cbc27e66ebe62babb4

SHA1
ac65f90fef28ce0fa06a56cda9f09d0c35794722

SHA256
f8c85581e4242eaf3fe23f504184ec7c9b7d8d886ddc7bbb10cb5e59097a6f62

SHA512
fd41152ac35f9c6e375da2519425405028a2b28cbac071fb07fb73d844add9eb3352d648b30125df98f2b7d8cbfda7ca5ce6772530f9c618782d8c217ab5d198

Download Submit
memory/212-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/212-1-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/212-2-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/212-12-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4584-10-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4584-11-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4584-13-0x0000000002150000-0x0000000002488000-memory.dmp

Filesize
3.2MB

Download
memory/4584-14-0x0000000002150000-0x0000000002488000-memory.dmp

Filesize
3.2MB

Download