cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a

Analysis

max time kernel
120s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 07:26

Target

cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe
Size

97KB
MD5

113b5c541bc1b23f3a34f88b546b4deb
SHA1

bc79538a2d97781a8a6cfa62ce1ff58d23bdbe09
SHA256

cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a
SHA512

51ae733cbc6ee0975dee75652117ffc0bc4f2ac4d558aec79e55db92756b631aca7f05f0a10af856ad602cb5664b1acf28cc3bb3432c36da5140679ea317d43b
SSDEEP

1536:90FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prK2mVEhS:9GS4jHS8q/3nTzePCwNUh4E9hor

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
984	egfpslwoqm

Loads dropped DLL 2 IoCs

pid	Process
284	cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe
284	cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 284 wrote to memory of 984	284	cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe	27
PID 284 wrote to memory of 984	284	cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe	27
PID 284 wrote to memory of 984	284	cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe	27
PID 284 wrote to memory of 984	284	cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe	27

C:\Users\Admin\AppData\Local\Temp\cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe
"C:\Users\Admin\AppData\Local\Temp\cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:284
- \??\c:\users\admin\appdata\local\egfpslwoqm
  "C:\Users\Admin\AppData\Local\Temp\cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe" a -sc:\users\admin\appdata\local\temp\cb2e5d88032f1a8b32f7f7050335580e0af9d6d18b83fc709ee9ebaf22f3c45a.exe
  2⤵
  - Executes dropped EXE
  PID:984

C:\Users\Admin\AppData\Local\egfpslwoqm

Filesize
23.8MB

MD5
c6e5774da4082d4dc8991a435553e09a

SHA1
1c64d0098b483998af816fd99e0c959758da498e

SHA256
d7047376432027adff22675e19857362c70cccb89ff631c171a519aa386449ec

SHA512
fb69ad2691186295155704d4dbc41519e73c667de63fa7d525c0cc582c6fe2f32f5285a36c6872c2c240676237cc5a7fd6c308336c21429739b3bbcb714c4c7f

Download Submit
\Users\Admin\AppData\Local\egfpslwoqm

Filesize
23.8MB

MD5
c6e5774da4082d4dc8991a435553e09a

SHA1
1c64d0098b483998af816fd99e0c959758da498e

SHA256
d7047376432027adff22675e19857362c70cccb89ff631c171a519aa386449ec

SHA512
fb69ad2691186295155704d4dbc41519e73c667de63fa7d525c0cc582c6fe2f32f5285a36c6872c2c240676237cc5a7fd6c308336c21429739b3bbcb714c4c7f

Download Submit
\Users\Admin\AppData\Local\egfpslwoqm

Filesize
23.8MB

MD5
c6e5774da4082d4dc8991a435553e09a

SHA1
1c64d0098b483998af816fd99e0c959758da498e

SHA256
d7047376432027adff22675e19857362c70cccb89ff631c171a519aa386449ec

SHA512
fb69ad2691186295155704d4dbc41519e73c667de63fa7d525c0cc582c6fe2f32f5285a36c6872c2c240676237cc5a7fd6c308336c21429739b3bbcb714c4c7f

Download Submit
memory/284-54-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/284-55-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/984-60-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download
memory/984-61-0x0000000000400000-0x000000000044E2DC-memory.dmp

Filesize
312KB

Download