a01c2ba7b2ba1efc975b5c29571f8c0add973a48f6916f58b11b64477437f8ca

Analysis

max time kernel
46s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 17:16

Target

a01c2ba7b2ba1efc975b5c29571f8c0add973a48f6916f58b11b64477437f8ca.exe
Size

16KB
MD5

a02841921653daa4599290b58a5b68b8
SHA1

245879e2faed6511d9d30b58ae54ed12abf10ef8
SHA256

a01c2ba7b2ba1efc975b5c29571f8c0add973a48f6916f58b11b64477437f8ca
SHA512

7b4f52f68fa14cbde01204146b7ca2b91376cc2b6bc71bcf94378c5ddea3c60231dca2f1ce28b50860c1f93772708b50143ddd67df37d56f43e0606da9d0c85e
SSDEEP

96:CXTacedhER/uEq8zH1gWxq2sjq+ArVkxeUIjTT8jtPtboynwEzs:8aceL8Q8ZgWbFiLUTiP1oynwx

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1356	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1356	1376	a01c2ba7b2ba1efc975b5c29571f8c0add973a48f6916f58b11b64477437f8ca.exe	26
PID 1376 wrote to memory of 1356	1376	a01c2ba7b2ba1efc975b5c29571f8c0add973a48f6916f58b11b64477437f8ca.exe	26
PID 1376 wrote to memory of 1356	1376	a01c2ba7b2ba1efc975b5c29571f8c0add973a48f6916f58b11b64477437f8ca.exe	26
PID 1376 wrote to memory of 1356	1376	a01c2ba7b2ba1efc975b5c29571f8c0add973a48f6916f58b11b64477437f8ca.exe	26

C:\Users\Admin\AppData\Local\Temp\a01c2ba7b2ba1efc975b5c29571f8c0add973a48f6916f58b11b64477437f8ca.exe
"C:\Users\Admin\AppData\Local\Temp\a01c2ba7b2ba1efc975b5c29571f8c0add973a48f6916f58b11b64477437f8ca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\\del_temp.bat
  2⤵
  - Deletes itself
  PID:1356

C:\Users\Admin\AppData\Local\Temp\del_temp.bat

Filesize
246B

MD5
7e071009419999de7036d6e29ef29a6e

SHA1
546604053891280192c70edaddb62c1dbfaaa1c1

SHA256
82cc52a36dd78195964a5a6692b52d8f36b8ec8c1a25bfbb48c1affa6d039878

SHA512
282c4f537351f39324df0d1a220ded22cd0a7c1b61934bda8bd70910eb17f6e7708f1c85b6b892f23e14172ba8bb62561faaa1c5ade50d0feab88698187e8217

Download Submit
memory/1376-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download