6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 04:34

Target

6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe
Size

568KB
MD5

92c117e3dea5e42c9c7c43156f001610
SHA1

72483696ee47a7f8281ba2b79620bf8e79162d5e
SHA256

6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4
SHA512

7e2bbc3c0005bbb3aeba813a78d38a516b4250f0acac4d1549bad0e2d45e6a2c0843282e2700a0ca90f2d59032fea6eeafb12231d152e5cc93d2d9834fcdd8a4
SSDEEP

6144:fZfV+kxG0TuVgE1Eax5wb/y0GjwAYmD3cPD419b6EHVCWrWohlCDhg2H:R9+kkxEax5a/9vq9b11fZ+DS

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1788	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
288	6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe
288	6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1788	288	6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe	27
PID 288 wrote to memory of 1788	288	6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe	27
PID 288 wrote to memory of 1788	288	6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe	27
PID 288 wrote to memory of 1788	288	6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe	27

C:\Users\Admin\AppData\Local\Temp\6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe
"C:\Users\Admin\AppData\Local\Temp\6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe_And DeleteMe.bat""
  2⤵
  - Deletes itself
  PID:1788

C:\Users\Admin\AppData\Local\Temp\6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe_And DeleteMe.bat

Filesize
246B

MD5
807bc85e2c3484a8170e8ba09535308d

SHA1
bba4c499b8a7bfe67b3551d509314dee3a57551a

SHA256
dcc5f5ac2b348e329f2db8d88b5217740215088159796eb95ec4f7358da2a9c3

SHA512
796f73241671d00cd0ded690619776dc02d278601ba1c850c9c7341c863d9361ce626de9c3e8c6603ee2d9b49cd04488ddf7d9fa941813d3c712105c66e9fc79

Download Submit
memory/288-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download