Cuckoo Sandbox

Name	5b022bc3a058c0a8_wuauclt.exe Download Submit file
Filepath	C:\ProgramData\Update\wuauclt.exe
Size	135.3KB
Processes	592 (e17b2badefe5cbb0ed0a808d1bd7f1d8faba852ea85e214730e7ba17dca99804.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`fe3f38b69d38dbf5ffc64238e6a1a3e7`
SHA1	`e9de7e567e09bb891b5d3d2f0c01d07ccc40cf8f`
SHA256	`5b022bc3a058c0a87cabe842039403aab374d57612ee557509d010e33b87f14f`
CRC32	`7F3292D0`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords CrowdStrike_CSIT_18197_01 - Detects plaintext version of strings observed in SILENT CHOLLIMA Rifdoor malware anti_dbg - Checks if being debugged win_mutex - Create or check mutex win_registry - Affect system registries win_files_operation - Affect private profile
VirusTotal	Search for analysis

Dropped Files