c203f54c9cb5f39279de31e42b4ecf80fea8005d77c03ff20b1cd7cccd0c0620

Analysis

Target
cbaa6b69554effbf2b60f9829e50b717.exe
Size 1.1MB
Sample210725-93qppct24n
SHA256 c203f54c9cb5f39279de31e42b4ecf80fea8005d77c03ff20b1cd7cccd0c0620
MD5 cbaa6b69554effbf2b60f9829e50b717
SHA1 d1ec7b45777d4e0e02cc4f32ba0cc08010044617
SHA512 9528072fcfb843cc81d63818e2637937d220e35c3eaaee6ea90df003f0228eb44693cf5c91ef8255720bffeede5b8f83038a5f255b73057ec0708b8a5e0819e8
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	2756	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2756	rundll32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Jvgzbfh.tmp	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2756	4060	cbaa6b69554effbf2b60f9829e50b717.exe	75
PID 4060 wrote to memory of 2756	4060	cbaa6b69554effbf2b60f9829e50b717.exe	75
PID 4060 wrote to memory of 2756	4060	cbaa6b69554effbf2b60f9829e50b717.exe	75

C:\Users\Admin\AppData\Local\Temp\cbaa6b69554effbf2b60f9829e50b717.exe
"C:\Users\Admin\AppData\Local\Temp\cbaa6b69554effbf2b60f9829e50b717.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\CBAA6B~1.TMP,S C:\Users\Admin\AppData\Local\Temp\CBAA6B~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:2756

memory/4060-114-0x0000000002890000-0x000000000298F000-memory.dmp

Download

memory/4060-115-0x0000000000400000-0x0000000000986000-memory.dmp

Download