fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b

Analysis

max time kernel
70s
max time network
145s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 23:21

Target

fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe
Size

557KB
MD5

5e10a4f35d1e216261c730497a20978e
SHA1

483e76742da939ba47def0f085088adcf870be2a
SHA256

fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b
SHA512

e5e47f6e4e6bfd1261572c6c3f4cf36813895a6b380565de633c933533f0a16695909aceb4521e1e7ced58ba341c485f97ecb0250841b336918932c379974934
SSDEEP

12288:EkEzbUd4JFPjRqh1MusAs+rpxPbEHmnqosDfXKP:EkEzbUd+CfsepZbEsXsfaP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
676	cmd.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dticisab.nw.dwa	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe
File created	C:\Windows\SysWOW64\dticisab.nt	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe
File opened for modification	C:\Windows\SysWOW64\dticisab.nt	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe
File opened for modification	C:\Windows\SysWOW64\dticisab.nw	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 676	1812	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe	30
PID 1812 wrote to memory of 676	1812	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe	30
PID 1812 wrote to memory of 676	1812	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe	30
PID 1812 wrote to memory of 676	1812	fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe	30

C:\Users\Admin\AppData\Local\Temp\fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe
"C:\Users\Admin\AppData\Local\Temp\fe7e4bdd1c9e7bd3739198850e55d36d8c89db505e22fa88ebbe159c4209ef6b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$203130531.bat
  2⤵
  - Deletes itself
  PID:676

C:\Users\Admin\AppData\Local\Temp\$203130531.bat

Filesize
184B

MD5
fbb10f6dc5aeb3fffaa15c2c704b637c

SHA1
12dc2510b7e341dc69a99f109479eb61a461da35

SHA256
9b719d5d36aa512c5bc60e8f04921a220771a9c32e8dbb9a4ca18a9dd8b005da

SHA512
f8f0d0fbcfaeb31a7f80e11f0394d33e5e669be4444eb642f3661776daa588117222e2dbf6986586f6c500abe598b689b6015d3f057d131377cc53e34d6d8aec

Download Submit
memory/1812-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download