bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4

Analysis

max time kernel
13s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 05:13

Target

bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe
Size

664KB
MD5

362115cb5a09aca821507856e9103cc1
SHA1

08f6fdc011fc845aa031b61786dc98ae411a7219
SHA256

bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4
SHA512

d9267679a9c263eeafd9b5930ea8dca2f0e7b53c26a1857e45ab10a0c4aa922a3d53f84a9188b076f3afcb7b5c19b5883fa9f43fd0ec4826bfa7c0b46b215c5f
SSDEEP

12288:h6Qyv5+vt/2z9olD6669/M+l6nRSciC1qfyI2stDzZ6JvEl+UgKsXBeGdnbH:hO5+v4olDK9/M/PhqV2+Z6JvJVKYeGdr

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1504	~DFA6F.tmp

Loads dropped DLL 1 IoCs

pid	Process
976	bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 1504	976	bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe	27
PID 976 wrote to memory of 1504	976	bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe	27
PID 976 wrote to memory of 1504	976	bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe	27
PID 976 wrote to memory of 1504	976	bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe	27

C:\Users\Admin\AppData\Local\Temp\bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe
"C:\Users\Admin\AppData\Local\Temp\bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:976
- C:\Users\Admin\AppData\Local\Temp\~DFA6F.tmp
  C:\Users\Admin\AppData\Local\Temp\~DFA6F.tmp OK
  2⤵
  - Executes dropped EXE
  PID:1504

C:\Users\Admin\AppData\Local\Temp\~DFA6F.tmp

Filesize
665KB

MD5
d5c6bff07d9e273071200cc79b2bbb34

SHA1
c2d9524ebc19405f28d52088f0671e868905816b

SHA256
5ef03aee979a7f97e39fcf38a573b1e33b31e5bb0882c3c836fb5598c9290869

SHA512
2282408fefaee441e13bb4adc637a3d5041d85cb1a4bf5189f3aebc81d32446d86db987ea71c500f6ae0064845d7a8a9beff71935acefaf427105dacd7256cb3

Download Submit
\Users\Admin\AppData\Local\Temp\~DFA6F.tmp

Filesize
665KB

MD5
d5c6bff07d9e273071200cc79b2bbb34

SHA1
c2d9524ebc19405f28d52088f0671e868905816b

SHA256
5ef03aee979a7f97e39fcf38a573b1e33b31e5bb0882c3c836fb5598c9290869

SHA512
2282408fefaee441e13bb4adc637a3d5041d85cb1a4bf5189f3aebc81d32446d86db987ea71c500f6ae0064845d7a8a9beff71935acefaf427105dacd7256cb3

Download Submit
memory/976-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/976-59-0x0000000000C20000-0x0000000000CDF000-memory.dmp

Filesize
764KB

Download
memory/976-60-0x0000000000A30000-0x0000000000AEF000-memory.dmp

Filesize
764KB

Download
memory/976-62-0x0000000000C20000-0x0000000000CDF000-memory.dmp

Filesize
764KB

Download
memory/1504-61-0x0000000000CE0000-0x0000000000D9F000-memory.dmp

Filesize
764KB

Download
memory/1504-63-0x0000000000CE0000-0x0000000000D9F000-memory.dmp

Filesize
764KB

Download