546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5

Analysis

max time kernel
108s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 13:30

Target

546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5.exe
Size

98KB
MD5

5254b8f557e9234701b2974c476e8c3c
SHA1

8714e109c9a3d3c2a55a1176060c54b76cb39678
SHA256

546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5
SHA512

c0bc208a8a184fcd914f35502ebab99c015a2b87a3087860825a8250089121bee8ac7253a92f25f839ba3cc68e7ff03132a2e9aa25c4e877894bf855db6ad173
SSDEEP

1536:0pFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8pr1CDPODmqo5Rh/b:0/S4jHS8q/3nTzePCwNUh4E9G87Gb

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1588	ewtmxcmhfy

Loads dropped DLL 2 IoCs

pid	Process
2020	546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5.exe
2020	546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1588	2020	546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5.exe	26
PID 2020 wrote to memory of 1588	2020	546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5.exe	26
PID 2020 wrote to memory of 1588	2020	546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5.exe	26
PID 2020 wrote to memory of 1588	2020	546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5.exe	26

C:\Users\Admin\AppData\Local\Temp\546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5.exe
"C:\Users\Admin\AppData\Local\Temp\546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020
- \??\c:\users\admin\appdata\local\ewtmxcmhfy
  "C:\Users\Admin\AppData\Local\Temp\546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5.exe" a -sc:\users\admin\appdata\local\temp\546dfbdcf904d726960dd8db1934f21b578c454a7902bbbcff24c6cf5b69e1f5.exe
  2⤵
  - Executes dropped EXE
  PID:1588

C:\Users\Admin\AppData\Local\ewtmxcmhfy

Filesize
24.9MB

MD5
0cde188e177857c0a2c80e147753bcda

SHA1
45d3acfb6bff18a55e9fd901feeec5203f3a1942

SHA256
03f116fe131e6bb5c2ab15aa639e5e2c5ff47b3b3b3c80686e514d5831de010e

SHA512
9a34a2e77550049a06179dc2bd844f7a55bf9999f83f562243829586ac675ce1bed5bae07639b47036d20374abe3ee738d9bac033ca07a36295c82490d619ad3

Download Submit
\Users\Admin\AppData\Local\ewtmxcmhfy

Filesize
24.9MB

MD5
0cde188e177857c0a2c80e147753bcda

SHA1
45d3acfb6bff18a55e9fd901feeec5203f3a1942

SHA256
03f116fe131e6bb5c2ab15aa639e5e2c5ff47b3b3b3c80686e514d5831de010e

SHA512
9a34a2e77550049a06179dc2bd844f7a55bf9999f83f562243829586ac675ce1bed5bae07639b47036d20374abe3ee738d9bac033ca07a36295c82490d619ad3

Download Submit
\Users\Admin\AppData\Local\ewtmxcmhfy

Filesize
24.9MB

MD5
0cde188e177857c0a2c80e147753bcda

SHA1
45d3acfb6bff18a55e9fd901feeec5203f3a1942

SHA256
03f116fe131e6bb5c2ab15aa639e5e2c5ff47b3b3b3c80686e514d5831de010e

SHA512
9a34a2e77550049a06179dc2bd844f7a55bf9999f83f562243829586ac675ce1bed5bae07639b47036d20374abe3ee738d9bac033ca07a36295c82490d619ad3

Download Submit
memory/1588-60-0x0000000000400000-0x000000000044E364-memory.dmp

Filesize
312KB

Download
memory/1588-61-0x0000000000400000-0x000000000044E364-memory.dmp

Filesize
312KB

Download
memory/2020-54-0x0000000000400000-0x000000000044E364-memory.dmp

Filesize
312KB

Download
memory/2020-55-0x0000000000400000-0x000000000044E364-memory.dmp

Filesize
312KB

Download