0a2c9e5ce709264618ad11716c950322e325fa8282132d23274e877dea4335cf

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 14:56

Target

0a2c9e5ce709264618ad11716c950322e325fa8282132d23274e877dea4335cf.exe
Size

1013KB
MD5

08cc8d63928187c405cfc5d3f538d68c
SHA1

5b52c843b2975ccf7d572422f7d1e0d3e319edff
SHA256

0a2c9e5ce709264618ad11716c950322e325fa8282132d23274e877dea4335cf
SHA512

e9aff4280b2fb9b3ba1a9fc05203180f6c656572af1d973365d80640e48b79e1d7207b489161fcc0bd1f2f854e36c6f568086001c0330a1230f1c0ba975ee0b0
SSDEEP

24576:19b4AAP4lPtN2Kh7I8iRp2q6IYjAKKzeROCQquQtlTplex6Je:Hb4x4F55I8iRAq6IaAFCXxpl5c

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1228	cmd.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1228	860	0a2c9e5ce709264618ad11716c950322e325fa8282132d23274e877dea4335cf.exe	27
PID 860 wrote to memory of 1228	860	0a2c9e5ce709264618ad11716c950322e325fa8282132d23274e877dea4335cf.exe	27
PID 860 wrote to memory of 1228	860	0a2c9e5ce709264618ad11716c950322e325fa8282132d23274e877dea4335cf.exe	27
PID 860 wrote to memory of 1228	860	0a2c9e5ce709264618ad11716c950322e325fa8282132d23274e877dea4335cf.exe	27

C:\Users\Admin\AppData\Local\Temp\0a2c9e5ce709264618ad11716c950322e325fa8282132d23274e877dea4335cf.exe
"C:\Users\Admin\AppData\Local\Temp\0a2c9e5ce709264618ad11716c950322e325fa8282132d23274e877dea4335cf.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c .\SDelinves_1.bat
  2⤵
  - Deletes itself
  PID:1228

C:\Users\Admin\AppData\Local\Temp\SDelinves_1.bat

Filesize
276B

MD5
d54707d368bac1f38e3cc4596ba0d4a7

SHA1
ca5a811bf801732b2e78b893611c46453dffac5e

SHA256
5b44f2f34bfd612bc742d4f93cb00408567cdeff87180e4ec840094fb26aed2a

SHA512
def837c1150555a02d4864db5026e2dafdf7e33a71df650481859047f2c22449a2b028e7bb71b35c86b552696c152204ad0634bb7c4533d3485450abd4b97b6e

Download Submit
memory/860-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download