9e1756aee8c367b9294240c2b7d21497c9e941b9faf1836046884a7f251bc59e

Analysis

max time kernel
129s
max time network
167s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 22:07

Target

9e1756aee8c367b9294240c2b7d21497c9e941b9faf1836046884a7f251bc59e.exe
Size

35KB
MD5

0d7db8101210dab8a32771e01444b032
SHA1

6dd056558c994d1713dc0003042948e8c6e13763
SHA256

9e1756aee8c367b9294240c2b7d21497c9e941b9faf1836046884a7f251bc59e
SHA512

aac680aff7a2de4a87da37dd864a67c008716dc087ac549ded7837cda4032c01abe44c56932f62f6913c92cd312c98158970e7a3a2427ebbb9e4435c1cbb6d5f
SSDEEP

384:l61mhT54/Zp/EnaF4se8oE/vQ9pR2BqVuq5f8Jp5LbhD5bgTsBqiBuf/kg:l61md52t4sHSpR2AEqeHxBgYJS

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1516	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	myip.dnsomatic.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
996	9e1756aee8c367b9294240c2b7d21497c9e941b9faf1836046884a7f251bc59e.exe
996	9e1756aee8c367b9294240c2b7d21497c9e941b9faf1836046884a7f251bc59e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 1516	996	9e1756aee8c367b9294240c2b7d21497c9e941b9faf1836046884a7f251bc59e.exe	27
PID 996 wrote to memory of 1516	996	9e1756aee8c367b9294240c2b7d21497c9e941b9faf1836046884a7f251bc59e.exe	27
PID 996 wrote to memory of 1516	996	9e1756aee8c367b9294240c2b7d21497c9e941b9faf1836046884a7f251bc59e.exe	27
PID 996 wrote to memory of 1516	996	9e1756aee8c367b9294240c2b7d21497c9e941b9faf1836046884a7f251bc59e.exe	27

C:\Users\Admin\AppData\Local\Temp\9e1756aee8c367b9294240c2b7d21497c9e941b9faf1836046884a7f251bc59e.exe
"C:\Users\Admin\AppData\Local\Temp\9e1756aee8c367b9294240c2b7d21497c9e941b9faf1836046884a7f251bc59e.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Deletes itself
  PID:1516

memory/996-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/996-56-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1516-59-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/1516-58-0x0000000000EC0000-0x0000000000EC8000-memory.dmp

Filesize
32KB

Download