aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 22:09

Target

aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe
Size

1.9MB
MD5

7f8eb66554dd21b6cd3841dac7ed558c
SHA1

88aabf681c83823fc4f88903c401c0a2acce566f
SHA256

aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed
SHA512

911f1863d0df323b7c8d7b07cfd2f20fd3939403c02a3d04dc988faee028e4b7c75f33d44fad95a87e6dc76111755cb2a197b1376a7703cf1867f6fa833026ec
SSDEEP

49152:dy8a7aZkQu/TR+oaPttRFUWc0CHrQC5x5IvwP1wRFJ1aU:odmZgV+lP9uWc0CQC5x5IuC1R

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
272	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.tmp

Loads dropped DLL 1 IoCs

pid	Process
1132	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 272	1132	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe	28
PID 1132 wrote to memory of 272	1132	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe	28
PID 1132 wrote to memory of 272	1132	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe	28
PID 1132 wrote to memory of 272	1132	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe	28
PID 1132 wrote to memory of 272	1132	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe	28
PID 1132 wrote to memory of 272	1132	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe	28
PID 1132 wrote to memory of 272	1132	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe	28

C:\Users\Admin\AppData\Local\Temp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe
"C:\Users\Admin\AppData\Local\Temp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\is-8NOQF.tmp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8NOQF.tmp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.tmp" /SL5="$80124,1718962,58368,C:\Users\Admin\AppData\Local\Temp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe"
  2⤵
  - Executes dropped EXE
  PID:272

C:\Users\Admin\AppData\Local\Temp\is-8NOQF.tmp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.tmp

Filesize
702KB

MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
\Users\Admin\AppData\Local\Temp\is-8NOQF.tmp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.tmp

Filesize
702KB

MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
memory/1132-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1132-55-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1132-61-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download