7b9144229e766f72f65c05663326e2978daf3335df67eeb5987009170f09c922

Analysis

max time kernel
137s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 15:16

Target

de5107b1db89c23fb6f4b06325459e9b.exe
Size

38KB
MD5

de5107b1db89c23fb6f4b06325459e9b
SHA1

f33c013c773afa5efc00e9fca4525436a788fafc
SHA256

7b9144229e766f72f65c05663326e2978daf3335df67eeb5987009170f09c922
SHA512

88c4960723caefc4b8a40b3c6224c344e48671e85754db0842971110676ba5539fb20b23d24f30401dfe9bcfa1ea7648ebe731c4188113fe8a6a1ef5e0bdf10a
SSDEEP

768:DN6wDS7t8JUY2TRbS5dI3XXcahumP4hGt8TJfYsBFvCM:DPeeJUFNYy3XXc0DP47TdY8C

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kr_done1	de5107b1db89c23fb6f4b06325459e9b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1584	de5107b1db89c23fb6f4b06325459e9b.exe
1584	de5107b1db89c23fb6f4b06325459e9b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1160	1584	de5107b1db89c23fb6f4b06325459e9b.exe	91
PID 1584 wrote to memory of 1160	1584	de5107b1db89c23fb6f4b06325459e9b.exe	91
PID 1584 wrote to memory of 1160	1584	de5107b1db89c23fb6f4b06325459e9b.exe	91

C:\Users\Admin\AppData\Local\Temp\de5107b1db89c23fb6f4b06325459e9b.exe
"C:\Users\Admin\AppData\Local\Temp\de5107b1db89c23fb6f4b06325459e9b.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninste575c1a.bat" "C:\Users\Admin\AppData\Local\Temp\de5107b1db89c23fb6f4b06325459e9b.exe""
  2⤵
  PID:1160

C:\Users\Admin\AppData\Local\Temp\uninste575c1a.bat

Filesize
59B

MD5
2988b921fbed03f9c93c5d538932bbe3

SHA1
4b791b3d59ae76ff091c2cf201b40f5d1b432a3f

SHA256
a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3

SHA512
2920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9

Download Submit
memory/1584-3-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1584-4-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1584-7-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download