5bb01fddeab37d40950557a434ccb152d2d6aa10bc594dbda467d58df7222ced

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 05:29

Target

5bb01fddeab37d40950557a434ccb152d2d6aa10bc594dbda467d58df7222ced.exe
Size

156KB
MD5

04a773759b0bd2874f9d37bc82f630b4
SHA1

b0861b7283e797e00ddfca0c48f39e01c06b9e7c
SHA256

5bb01fddeab37d40950557a434ccb152d2d6aa10bc594dbda467d58df7222ced
SHA512

830c9f40051e1ff3353ff9069b0d6d447c9c30e3c9623ac4fca1614991fb26d2ae89b70a6014159821b346eef3a31620232b287a549bdd5566172b679e908538
SSDEEP

3072:m3Co9d8+vMFp8cp3KaVMcv7lzzatYNMCvCXoQDt5:vojc8aacvBfaIG5

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1576	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1576	1752	5bb01fddeab37d40950557a434ccb152d2d6aa10bc594dbda467d58df7222ced.exe	27
PID 1752 wrote to memory of 1576	1752	5bb01fddeab37d40950557a434ccb152d2d6aa10bc594dbda467d58df7222ced.exe	27
PID 1752 wrote to memory of 1576	1752	5bb01fddeab37d40950557a434ccb152d2d6aa10bc594dbda467d58df7222ced.exe	27
PID 1752 wrote to memory of 1576	1752	5bb01fddeab37d40950557a434ccb152d2d6aa10bc594dbda467d58df7222ced.exe	27

C:\Users\Admin\AppData\Local\Temp\5bb01fddeab37d40950557a434ccb152d2d6aa10bc594dbda467d58df7222ced.exe
"C:\Users\Admin\AppData\Local\Temp\5bb01fddeab37d40950557a434ccb152d2d6aa10bc594dbda467d58df7222ced.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\sdfkb.bat
  2⤵
  - Deletes itself
  PID:1576

C:\Users\Admin\AppData\Local\Temp\sdfkb.bat

Filesize
520B

MD5
da82cd268a6b11860e186f956a43d36f

SHA1
2ddeee76aa529445de4c072d268aa35149a70edb

SHA256
78db87d56ca9c3aee471c85836ba5001c6a69c42f97a3bbe6dbb4f513c99e190

SHA512
57ae7c71ee8768825e49b6a2f8da89c0e93de1165d61e45e0fc96b1fc44d2985ede58887e633e200dffe958972c06c31848a2f9c3668094694b7c53e042267c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\sdfkb~.tmp

Filesize
156KB

MD5
e2366c8d07f37cd8c46a8e8c416961f4

SHA1
93abbd0cbd628232fa82b28a5182f1fb2ab98804

SHA256
9f1baddf7e51bc7688074c2c1545a930b4b09ff9f43a143d3f560d3ea526d0ac

SHA512
4c96017153c237bd091ff937ee29167b3700f4ab0c33b33e96f25e53d10e90a4122789e736353e855b76a865b57e5bbf53d03887663acdb210c65622cf5f1f6d

Download Submit
memory/1576-55-0x0000000000000000-mapping.dmp

Download
memory/1752-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download