8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f

Analysis

Target

8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe
Size

152KB
MD5

54ce74d7da4e96422bbe999c75f4e8f4
SHA1

64ef5b1d805794ab861cd6126d70021a8712b279
SHA256

8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f
SHA512

c3b9e610d56537e969a772406955dd4bf2ef1c8ec7ac0a771c7f6ffcf6f0be0a99025a5f2109689c56f3c9a55c0cbfecf45f15b3e91e0570a9e24eb8956aaa2e

Score

8^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe

description	pid	process	target process
PID 1496 wrote to memory of 1804	1496	8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe	bdif.exe
PID 1496 wrote to memory of 1804	1496	8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe	bdif.exe
PID 1496 wrote to memory of 1804	1496	8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe	bdif.exe
PID 1496 wrote to memory of 1804	1496	8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe	bdif.exe

Executes dropped EXE 1 IoCs

Processes:

bdif.exe

pid process

1804 bdif.exe

pid	process
1804	bdif.exe

NTFS ADS 1 IoCs

Processes:

8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe

description	ioc	process
File created	\??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier	8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe

Loads dropped DLL 1 IoCs

Processes:

8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe

pid process

1496 8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe

pid	process
1496	8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe

\??\c:\programdata\e6533cd889\bdif.exe
c:\programdata\e6533cd889\bdif.exe
2⤵
- Executes dropped EXE
PID:1804

C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86c

Download Submit
C:\ProgramData\e6533cd889\bdif.exe

Download Submit
\ProgramData\e6533cd889\bdif.exe

Download Submit
memory/1496-0-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/1496-1-0x0000000000230000-0x0000000000255000-memory.dmp

Filesize
148KB

Download
memory/1804-3-0x0000000000000000-mapping.dmp

Download
memory/1804-6-0x0000000000260000-0x0000000000285000-memory.dmp

Filesize
148KB

Download