486bdfa30d86eafc9fa6516ad67f6e7df39aa5fcbbe48f245e382ed38cc9adf8

Analysis

Target
486bdfa30d86eafc9fa6516ad67f6e7df39aa5fcbbe48f245e382ed38cc9adf8.exe
Size 152KB
Sample200709-ky2bavc8bn
SHA256 486bdfa30d86eafc9fa6516ad67f6e7df39aa5fcbbe48f245e382ed38cc9adf8
MD5 9e0d55ea6fbd06df70af866d0fe5bb79
SHA1 38023f98c48e7c30dcf1b538ada8888343d1ecad
SHA512 187e39b3a17883dcfcd621a33236c8fa8d19f1dbc03ef19cd91870e822c40798b76b640fa560b850b09432bc3ad2877a51a221d4750d075fa4fe3e64ad39b57e
MD5 SHA1 SHA512

Score

8^/10

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier	486bdfa30d86eafc9fa6516ad67f6e7df39aa5fcbbe48f245e382ed38cc9adf8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1904	640	486bdfa30d86eafc9fa6516ad67f6e7df39aa5fcbbe48f245e382ed38cc9adf8.exe	69
PID 640 wrote to memory of 1904	640	486bdfa30d86eafc9fa6516ad67f6e7df39aa5fcbbe48f245e382ed38cc9adf8.exe	69
PID 640 wrote to memory of 1904	640	486bdfa30d86eafc9fa6516ad67f6e7df39aa5fcbbe48f245e382ed38cc9adf8.exe	69

Executes dropped EXE 1 IoCs

pid	Process
1904	bdif.exe

C:\Users\Admin\AppData\Local\Temp\486bdfa30d86eafc9fa6516ad67f6e7df39aa5fcbbe48f245e382ed38cc9adf8.exe
"C:\Users\Admin\AppData\Local\Temp\486bdfa30d86eafc9fa6516ad67f6e7df39aa5fcbbe48f245e382ed38cc9adf8.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:640
- \??\c:\programdata\e6533cd889\bdif.exe
  c:\programdata\e6533cd889\bdif.exe
  2⤵
  - Executes dropped EXE
  PID:1904

memory/640-0-0x00000000001D0000-0x00000000001E0000-memory.dmp

Download

memory/640-1-0x0000000000540000-0x0000000000565000-memory.dmp

Download

memory/1904-6-0x00000000007C0000-0x00000000007E5000-memory.dmp

Download