9c3cfeccfffba1fe5b1b69a5784e3d2832a35aebd0998efb48877ae766708691

Analysis

Target
8sdsfd2sd.exe
Size 651KB
Sample210202-ttpscpe5w6
SHA256 9c3cfeccfffba1fe5b1b69a5784e3d2832a35aebd0998efb48877ae766708691
MD5 feb4484f965d53e26a67141c97c3ca19
SHA1 e21be6605ac1a0b3416df5e266a20c5b9581f4c3
SHA512 a3ebb40b47aa08bfa4b49955fa85b429f398bc16f882b91af10126b267e4a4e7b6edb2464aab91f9a980fa4d6bfeaf39b3359687a2ef4777ef50f6b5a6786d1f
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
1524	aitufifuvjh.exe
1020	aitufifuvjh.exe

Loads dropped DLL 3 IoCs

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1684	timeout.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1896	800	8sdsfd2sd.exe	26
PID 800 wrote to memory of 1896	800	8sdsfd2sd.exe	26
PID 800 wrote to memory of 1896	800	8sdsfd2sd.exe	26
PID 800 wrote to memory of 1896	800	8sdsfd2sd.exe	26
PID 1896 wrote to memory of 1524	1896	8sdsfd2sd.exe	30
PID 1896 wrote to memory of 1524	1896	8sdsfd2sd.exe	30
PID 1896 wrote to memory of 1524	1896	8sdsfd2sd.exe	30
PID 1524 wrote to memory of 1020	1524	aitufifuvjh.exe	31
PID 1524 wrote to memory of 1020	1524	aitufifuvjh.exe	31
PID 1524 wrote to memory of 1020	1524	aitufifuvjh.exe	31
PID 1524 wrote to memory of 1020	1524	aitufifuvjh.exe	31

C:\Users\Admin\AppData\Local\Temp\8sdsfd2sd.exe
"C:\Users\Admin\AppData\Local\Temp\8sdsfd2sd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\8sdsfd2sd.exe
  "C:\Users\Admin\AppData\Local\Temp\8sdsfd2sd.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Users\Admin\AppData\Local\Temp\aitufifuvjh.exe
    C:\Users\Admin\AppData\Local\Temp\aitufifuvjh.exe "C:\Users\Admin\AppData\Local\Temp\8sdsfd2sd.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\aitufifuvjh.exe
      C:\Users\Admin\AppData\Local\Temp\aitufifuvjh.exe "C:\Users\Admin\AppData\Local\Temp\8sdsfd2sd.exe"
      4⤵
      Executes dropped EXE
      PID:1020
    - - C:\Windows\explorer.exe
        
        explorer.exe "C:\Users\Admin\AppData\Local\Temp\8sdsfd2sd.exe" A
        5⤵
        
        PID:560
      - C:\Windows\system32\cmd.exe
        
        cmd /c TIMEOUT /T 50 /NOBREAK && move "C:\Users\Admin\AppData\Local\Temp\1536.tmp" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java SDK support.lnk"
        6⤵
        
        PID:1344
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT /T 50 /NOBREAK
        7⤵
        Delays execution with timeout.exe
        
        PID:1684

memory/560-17-0x00000000FFEB0000-0x00000000FFF9A000-memory.dmp

Download

memory/560-15-0x00000000FFEB0000-0x00000000FFF9A000-memory.dmp

Download

memory/616-21-0x000007FEF7C70000-0x000007FEF7EEA000-memory.dmp

Download

memory/1896-3-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Download