441cdd4362d5b31417260d6a6e4e8a3f09e00352f138349a5398c552e245071c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 20:59

Target

441cdd4362d5b31417260d6a6e4e8a3f09e00352f138349a5398c552e245071c.exe
Size

353KB
MD5

b7ac2135d48a2d8f1ef7f3eb22a82269
SHA1

f927ccc76811e0c1169b5a336ac209e611abe506
SHA256

441cdd4362d5b31417260d6a6e4e8a3f09e00352f138349a5398c552e245071c
SHA512

ac58f9d99bef8731c52ff44904c51438c136f927f2494ce73501038c2a1fcfcaeef17e1f3db470ee71976548caf57cfe05098f0ce794b0b185a7500be61cf91a
SSDEEP

6144:RqKvb0CYJ973e+eKZ2W+Dffz1gUZ3sOeNw0VqIJ/uJn9tvq3v3/sSQJw1TI:vvbxYX7Z2W+Dfhg0cvd5JIDvTJw1E

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5100	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	441cdd4362d5b31417260d6a6e4e8a3f09e00352f138349a5398c552e245071c.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	441cdd4362d5b31417260d6a6e4e8a3f09e00352f138349a5398c552e245071c.exe

C:\Users\Admin\AppData\Local\Temp\441cdd4362d5b31417260d6a6e4e8a3f09e00352f138349a5398c552e245071c.exe
"C:\Users\Admin\AppData\Local\Temp\441cdd4362d5b31417260d6a6e4e8a3f09e00352f138349a5398c552e245071c.exe"
1⤵
- Drops file in System32 directory
PID:3536
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  PID:5100

C:\Windows\SysWOW64\Zombie.exe

Filesize
69KB

MD5
7ea1bda86aa730309f38b605fb3317f6

SHA1
50433b25ff8f432d82f3fddd7cf575a272b6c4e3

SHA256
19cf5903c3861193de60c978f067fcf9bcef48acd43f10c53421e78783b4c5b6

SHA512
bf5280a1d9d5f2dde22e25ae15da838c5cf6aa61040b7fd95d9bc7bdfa4d4b683a2ffced3161196e44a0447bca4d74e80ebddc82981ca8f0af17060b4babb7af

Download Submit