ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0

Analysis

Target
ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe
Size 3.4MB
Sample200908-kdk9ydj296
SHA256 ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0
MD5 97e9bd85aad231de56b05e9872ffb2f6
SHA1 146a1e3d28dc53805af0dc105b4b4d0232dfa1d8
SHA512 1f52e0069586148ce383d9b526fe803e2d8f978a0c8f99b51995172a11c6fda21ba976ea2576053f129d3b0a3f9e8d0be1ae6213cd6a039c52c17fbb853e5f66
MD5 SHA1 SHA512

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
324	ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe
324	ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe

JavaScript code in executable 2 IoCs

resource	yara_rule
behavioral1/files/0x00040000000131ba-1.dat	js
behavioral1/files/0x00040000000131ba-2.dat	js

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 324	1292	ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe	24
PID 1292 wrote to memory of 324	1292	ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe	24
PID 1292 wrote to memory of 324	1292	ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe	24

C:\Users\Admin\AppData\Local\Temp\ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe
"C:\Users\Admin\AppData\Local\Temp\ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe
  "C:\Users\Admin\AppData\Local\Temp\ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe"
  2⤵
  - Loads dropped DLL
  PID:324

memory/1872-5-0x000007FEF7800000-0x000007FEF7A7A000-memory.dmp

Download