1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808

Analysis

Target

1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe
Size

56KB
MD5

5fe957ba6dc8c255da706b7bb2af5388
SHA1

7966db247cf123b31f89715b8510aaebbd14e185
SHA256

1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808
SHA512

15f42a64291a4bb5e60204d34a12054d4010d5d120da00b52030a87ad1569d43d4529016fbdcf64f662dd09cf81ab83f8b360aacc74b075f0c9092d04885942b

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1304	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1304	1984	1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe	27
PID 1984 wrote to memory of 1304	1984	1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe	27
PID 1984 wrote to memory of 1304	1984	1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe	27
PID 1984 wrote to memory of 1304	1984	1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe	27

C:\Users\Admin\AppData\Local\Temp\1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe
"C:\Users\Admin\AppData\Local\Temp\1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\1ccd8d4acd696b393f028877526eb3c56dc6c69f0b539c6a21c256476b415808.exe"
  2⤵
  - Deletes itself
  PID:1304

memory/1984-54-0x0000000000200000-0x000000000020B000-memory.dmp

Filesize
44KB

Download