486bdfa30d86eafc9fa6516ad67f6e7df39aa5fcbbe48f245e382ed38cc9adf8

Analysis

Target

9e0d55ea6fbd06df70af866d0fe5bb79.exe
Size

152KB
MD5

9e0d55ea6fbd06df70af866d0fe5bb79
SHA1

38023f98c48e7c30dcf1b538ada8888343d1ecad
SHA256

486bdfa30d86eafc9fa6516ad67f6e7df39aa5fcbbe48f245e382ed38cc9adf8
SHA512

187e39b3a17883dcfcd621a33236c8fa8d19f1dbc03ef19cd91870e822c40798b76b640fa560b850b09432bc3ad2877a51a221d4750d075fa4fe3e64ad39b57e

Score

8^/10

Loads dropped DLL 1 IoCs

Processes:

9e0d55ea6fbd06df70af866d0fe5bb79.exe

pid process

824 9e0d55ea6fbd06df70af866d0fe5bb79.exe

pid	process
824	9e0d55ea6fbd06df70af866d0fe5bb79.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9e0d55ea6fbd06df70af866d0fe5bb79.exe

description	pid	process	target process
PID 824 wrote to memory of 1416	824	9e0d55ea6fbd06df70af866d0fe5bb79.exe	bdif.exe
PID 824 wrote to memory of 1416	824	9e0d55ea6fbd06df70af866d0fe5bb79.exe	bdif.exe
PID 824 wrote to memory of 1416	824	9e0d55ea6fbd06df70af866d0fe5bb79.exe	bdif.exe
PID 824 wrote to memory of 1416	824	9e0d55ea6fbd06df70af866d0fe5bb79.exe	bdif.exe

Executes dropped EXE 1 IoCs

Processes:

bdif.exe

pid process

1416 bdif.exe
NTFS ADS 1 IoCs

Processes:

9e0d55ea6fbd06df70af866d0fe5bb79.exe

description ioc process

File created \??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier 9e0d55ea6fbd06df70af866d0fe5bb79.exe

pid	process
1416	bdif.exe

description	ioc	process
File created	\??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier	9e0d55ea6fbd06df70af866d0fe5bb79.exe

\??\c:\programdata\e6533cd889\bdif.exe
c:\programdata\e6533cd889\bdif.exe
2⤵
- Executes dropped EXE
PID:1416

C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86c

Download Submit
C:\ProgramData\e6533cd889\bdif.exe

Download Submit
\ProgramData\e6533cd889\bdif.exe

Download Submit
memory/824-0-0x00000000002B0000-0x00000000002C0000-memory.dmp

Filesize
64KB

Download
memory/824-1-0x00000000002C0000-0x00000000002E5000-memory.dmp

Filesize
148KB

Download
memory/1416-3-0x0000000000000000-mapping.dmp

Download
memory/1416-5-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/1416-6-0x00000000001C0000-0x00000000001E5000-memory.dmp

Filesize
148KB

Download