6a008f178e93b5f0a8099440e8f5dd952549e701b79ed722bbe71389fd1f59cb

Analysis

max time kernel
129s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:11

Target

6a008f178e93b5f0a8099440e8f5dd952549e701b79ed722bbe71389fd1f59cb.exe
Size

71KB
MD5

057adeed983103a2a037d1e68d32a160
SHA1

5839381436d893f08036a1722e5b960f5662a7d8
SHA256

6a008f178e93b5f0a8099440e8f5dd952549e701b79ed722bbe71389fd1f59cb
SHA512

334e01dce35a860c787f8cafa6a868e0f6657e475612fcf455c525d6693a15153ba29f2a033cd920bf350646f7ded710e48c6ec30203f14e5a910df3ab9fe6ac
SSDEEP

1536:1h3YrzjzGabh9X0PCig8Hf7j6iQ3e7Orp:jizj7bhtMC98/7pIe7m

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

itheakav.exe

pid process

396 itheakav.exe

pid	process
396	itheakav.exe

Drops file in System32 directory 2 IoCs

Processes:

6a008f178e93b5f0a8099440e8f5dd952549e701b79ed722bbe71389fd1f59cb.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\itheakav.exe	6a008f178e93b5f0a8099440e8f5dd952549e701b79ed722bbe71389fd1f59cb.exe
File created	C:\Windows\SysWOW64\itheakav.exe	6a008f178e93b5f0a8099440e8f5dd952549e701b79ed722bbe71389fd1f59cb.exe

C:\Users\Admin\AppData\Local\Temp\6a008f178e93b5f0a8099440e8f5dd952549e701b79ed722bbe71389fd1f59cb.exe
"C:\Users\Admin\AppData\Local\Temp\6a008f178e93b5f0a8099440e8f5dd952549e701b79ed722bbe71389fd1f59cb.exe"
1⤵
- Drops file in System32 directory
PID:1720

C:\Windows\SysWOW64\itheakav.exe
"C:\Windows\SysWOW64\itheakav.exe"
2⤵
- Executes dropped EXE
PID:396

C:\Windows\SysWOW64\itheakav.exe
Filesize
68KB

MD5
5f52e57985563b312d83671aaf896d18

SHA1
77e0839c6f0068f2694deb575ad5aea96a6be391

SHA256
8b7d952f1e272174d370cfaa0ef647d1b3d339353bd914e464cfd95dc77ca6a5

SHA512
d70f1b5b5c6c6407b3bd744428250e0ae3cf6f05e61f3d99886a59b8f82cda918dcb882b39b0eacc7fb2b8cc4c989ef62464b76692342cc2f0cffa646be85b71

Download Submit
memory/1720-0-0x0000000077B12000-0x0000000077B13000-memory.dmp

Filesize
4KB

Download
memory/1720-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download