59562338425f87c091a34b7c296cfdf2fb610cb8c8e86465c230ee474b15570e

Analysis

max time kernel
133s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 08:50

Target

59562338425f87c091a34b7c296cfdf2fb610cb8c8e86465c230ee474b15570e.exe
Size

39KB
MD5

404297d7f616b87593d17632a9da0f40
SHA1

0b19915aaec03c7333688153c6b6b12aa93531e1
SHA256

59562338425f87c091a34b7c296cfdf2fb610cb8c8e86465c230ee474b15570e
SHA512

cc209c7838e168f7df8bd4b711808548e9925ffec5e87323c8ba581c74bd3f987ca23740f11ab17cc039520eee45339cc4942d138082a7ba3086c6fa4063dec9
SSDEEP

768:/aRI0bgxqhoggiXw2nMz6D59wFcAXZ1wZ:/aLgTgDAoMz69wFcAXZ1wZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
684	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1668	59562338425f87c091a34b7c296cfdf2fb610cb8c8e86465c230ee474b15570e.exe
1668	59562338425f87c091a34b7c296cfdf2fb610cb8c8e86465c230ee474b15570e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 684	1668	59562338425f87c091a34b7c296cfdf2fb610cb8c8e86465c230ee474b15570e.exe	28
PID 1668 wrote to memory of 684	1668	59562338425f87c091a34b7c296cfdf2fb610cb8c8e86465c230ee474b15570e.exe	28
PID 1668 wrote to memory of 684	1668	59562338425f87c091a34b7c296cfdf2fb610cb8c8e86465c230ee474b15570e.exe	28
PID 1668 wrote to memory of 684	1668	59562338425f87c091a34b7c296cfdf2fb610cb8c8e86465c230ee474b15570e.exe	28

C:\Users\Admin\AppData\Local\Temp\59562338425f87c091a34b7c296cfdf2fb610cb8c8e86465c230ee474b15570e.exe
"C:\Users\Admin\AppData\Local\Temp\59562338425f87c091a34b7c296cfdf2fb610cb8c8e86465c230ee474b15570e.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Deletes itself
  PID:684

memory/684-54-0x0000000000000000-mapping.dmp

Download
memory/684-57-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download
memory/684-56-0x0000000000850000-0x0000000000858000-memory.dmp

Filesize
32KB

Download
memory/684-58-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/684-59-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download
memory/1668-55-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download