f0023927901cedd1868dd38f17210d3c9786f6d963b426dcd895875fbc2b26fe

Analysis

Target

25d570ff9d42df9425595dce21e00dd5.exe
Size

152KB
MD5

25d570ff9d42df9425595dce21e00dd5
SHA1

26698d3213003a4b9a8d1cdb2ca385b049616ee6
SHA256

f0023927901cedd1868dd38f17210d3c9786f6d963b426dcd895875fbc2b26fe
SHA512

2c6dd9d261fc1d9b717ead0bf2b9d8995aa977ab4fd67ed0dc7e7026306e2738fca9f283e8e0b37ececb2ec7187512c847da920a33720b9eb429d97c1a64dc18

Score

8^/10

Loads dropped DLL 1 IoCs

Processes:

25d570ff9d42df9425595dce21e00dd5.exe

pid process

1060 25d570ff9d42df9425595dce21e00dd5.exe

pid	process
1060	25d570ff9d42df9425595dce21e00dd5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

25d570ff9d42df9425595dce21e00dd5.exe

description	pid	process	target process
PID 1060 wrote to memory of 836	1060	25d570ff9d42df9425595dce21e00dd5.exe	bdif.exe
PID 1060 wrote to memory of 836	1060	25d570ff9d42df9425595dce21e00dd5.exe	bdif.exe
PID 1060 wrote to memory of 836	1060	25d570ff9d42df9425595dce21e00dd5.exe	bdif.exe
PID 1060 wrote to memory of 836	1060	25d570ff9d42df9425595dce21e00dd5.exe	bdif.exe

Executes dropped EXE 1 IoCs

Processes:

bdif.exe

pid process

836 bdif.exe
NTFS ADS 1 IoCs

Processes:

25d570ff9d42df9425595dce21e00dd5.exe

description ioc process

File created \??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier 25d570ff9d42df9425595dce21e00dd5.exe

pid	process
836	bdif.exe

description	ioc	process
File created	\??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier	25d570ff9d42df9425595dce21e00dd5.exe

\??\c:\programdata\e6533cd889\bdif.exe
c:\programdata\e6533cd889\bdif.exe
2⤵
- Executes dropped EXE
PID:836

C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86c

Download Submit
C:\ProgramData\e6533cd889\bdif.exe

Download Submit
\ProgramData\e6533cd889\bdif.exe

Download Submit
memory/836-3-0x0000000000000000-mapping.dmp

Download
memory/836-5-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/836-6-0x0000000000240000-0x0000000000265000-memory.dmp

Filesize
148KB

Download
memory/1060-0-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/1060-1-0x0000000000230000-0x0000000000255000-memory.dmp

Filesize
148KB

Download