cd9528ec9264325ed7fc6144c00eb5678ee2d478bdb0aaa1eada09b05742f1e8

Analysis

max time kernel
19s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 04:29

Target

cd9528ec9264325ed7fc6144c00eb5678ee2d478bdb0aaa1eada09b05742f1e8.exe
Size

68KB
MD5

9ad50fd4532cdca1f676caa76d2a29f1
SHA1

f045b265d4aa904009bddfd51ec678c91ed36e25
SHA256

cd9528ec9264325ed7fc6144c00eb5678ee2d478bdb0aaa1eada09b05742f1e8
SHA512

661cb039f283a88c562fc480036fff3ea796feec9dbba64a920269f94caf716d8ebb60f440e2288bb3572c59ddf05e992311a6632cd6f14d0b9b0e71c09cf12d
SSDEEP

384:+KA/x4PgumlHb5ofNq7uyyN2K7DEhnoV7NfWAWcUPZJke64J3X0TX2GVGoav3s4d:3A/2VdyAIhnoV7VOhWh4J3X0x7vc

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1696	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1000	cd9528ec9264325ed7fc6144c00eb5678ee2d478bdb0aaa1eada09b05742f1e8.exe
1000	cd9528ec9264325ed7fc6144c00eb5678ee2d478bdb0aaa1eada09b05742f1e8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1696	1000	cd9528ec9264325ed7fc6144c00eb5678ee2d478bdb0aaa1eada09b05742f1e8.exe	27
PID 1000 wrote to memory of 1696	1000	cd9528ec9264325ed7fc6144c00eb5678ee2d478bdb0aaa1eada09b05742f1e8.exe	27
PID 1000 wrote to memory of 1696	1000	cd9528ec9264325ed7fc6144c00eb5678ee2d478bdb0aaa1eada09b05742f1e8.exe	27
PID 1000 wrote to memory of 1696	1000	cd9528ec9264325ed7fc6144c00eb5678ee2d478bdb0aaa1eada09b05742f1e8.exe	27

C:\Users\Admin\AppData\Local\Temp\cd9528ec9264325ed7fc6144c00eb5678ee2d478bdb0aaa1eada09b05742f1e8.exe
"C:\Users\Admin\AppData\Local\Temp\cd9528ec9264325ed7fc6144c00eb5678ee2d478bdb0aaa1eada09b05742f1e8.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Deletes itself
  PID:1696

memory/1000-55-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1696-56-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1696-58-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/1696-57-0x0000000000950000-0x0000000000958000-memory.dmp

Filesize
32KB

Download