ab414d0ae73f20561c4f7cd81b143979a35176f859f52c5207872ee0ccb1659b

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/08/2024, 21:32

Target

HostsMod.exe
Size

2.6MB
MD5

76587f6496a36d5987785d76493ae933
SHA1

327599b82691d30bf05867b064574db87fb61022
SHA256

ab414d0ae73f20561c4f7cd81b143979a35176f859f52c5207872ee0ccb1659b
SHA512

ae1026a451a5f97310cd8ecafb616d4254326c9925e4e63a4f640f3a62d99cd9ca26b3a0c9b286cd0d3d0599c2b9e7c31d519a06c742d0b25d3d03995a195f8d
SSDEEP

49152:Qwjft2SYrFDVnp2Ede39cxkrH369i2QUIvJN9eBR3xlUfWLNC5AniWGmvISx:rYrFDCN552/UfWLNC5AnomvISx

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	HostsMod.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3048	2412	HostsMod.exe	32
PID 2412 wrote to memory of 3048	2412	HostsMod.exe	32
PID 2412 wrote to memory of 3048	2412	HostsMod.exe	32

C:\Users\Admin\AppData\Local\Temp\HostsMod.exe
"C:\Users\Admin\AppData\Local\Temp\HostsMod.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\curl https://raw.githubusercontent.com/GardeningTool/HostsMod/main/domains.txt > domains.txt
  2⤵
  PID:3048

memory/2412-0-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download