8bd0c2de7af721194571df16912e01228e4e1d2a2f26470d7947f231c05b4269

Resubmissions

02/11/2020, 09:24

02/11/2020, 08:10

Target
ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f.exe
Size 134KB
Sample201102-3my475sppj
SHA256 ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f
MD5 0a0b0ac20e9fe72753e74def1e37724f
SHA1 fd683b33ee10ba92e485f76fbad9b48a2e697358
SHA512 3f5d8b747955fc5926767c04be7c7d414205d01e8a2e586d3e94f2a4da756b56b15a795ec5847894b21b39fba7d595d18898df60375c126998e6b638cf78a759
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 3 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2296	4076	ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f.exe	78
PID 4076 wrote to memory of 2296	4076	ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f.exe	78
PID 4076 wrote to memory of 2296	4076	ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f.exe	78
PID 4076 wrote to memory of 564	4076	ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f.exe	79
PID 4076 wrote to memory of 564	4076	ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f.exe	79
PID 4076 wrote to memory of 564	4076	ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f.exe	79
PID 4076 wrote to memory of 2060	4076	ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f.exe	80
PID 4076 wrote to memory of 2060	4076	ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f.exe	80
PID 4076 wrote to memory of 2060	4076	ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f.exe	80

C:\Users\Admin\AppData\Local\Temp\ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f.exe
"C:\Users\Admin\AppData\Local\Temp\ec3da4ac9ec917e66ab943ab149119807922f64f2e4960ebadc36fe7520b300f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\VNrzmQbEnlan.exe
  "C:\Users\Admin\AppData\Local\Temp\VNrzmQbEnlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Users\Admin\AppData\Local\Temp\pAFPXkPEllan.exe
  "C:\Users\Admin\AppData\Local\Temp\pAFPXkPEllan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Users\Admin\AppData\Local\Temp\fiIzDXAhilan.exe
  "C:\Users\Admin\AppData\Local\Temp\fiIzDXAhilan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:2060