8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f

Analysis

Target

8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe
Size

152KB
MD5

54ce74d7da4e96422bbe999c75f4e8f4
SHA1

64ef5b1d805794ab861cd6126d70021a8712b279
SHA256

8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f
SHA512

c3b9e610d56537e969a772406955dd4bf2ef1c8ec7ac0a771c7f6ffcf6f0be0a99025a5f2109689c56f3c9a55c0cbfecf45f15b3e91e0570a9e24eb8956aaa2e

Score

8^/10

Loads dropped DLL 1 IoCs

Processes:

8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe

pid process

888 8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe

pid	process
888	8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe

description	pid	process	target process
PID 888 wrote to memory of 1380	888	8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe	bdif.exe
PID 888 wrote to memory of 1380	888	8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe	bdif.exe
PID 888 wrote to memory of 1380	888	8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe	bdif.exe
PID 888 wrote to memory of 1380	888	8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe	bdif.exe

Executes dropped EXE 1 IoCs

Processes:

bdif.exe

pid process

1380 bdif.exe

pid	process
1380	bdif.exe

NTFS ADS 1 IoCs

Processes:

8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe

description	ioc	process
File created	\??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier	8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe

\??\c:\programdata\e6533cd889\bdif.exe
c:\programdata\e6533cd889\bdif.exe
2⤵
- Executes dropped EXE
PID:1380

C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86c

Download Submit
C:\ProgramData\e6533cd889\bdif.exe

Download Submit
\ProgramData\e6533cd889\bdif.exe

Download Submit
memory/888-0-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/888-1-0x0000000000240000-0x0000000000265000-memory.dmp

Filesize
148KB

Download
memory/1380-3-0x0000000000000000-mapping.dmp

Download
memory/1380-5-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/1380-6-0x00000000001E0000-0x0000000000205000-memory.dmp

Filesize
148KB

Download