48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8

Analysis

max time kernel
12s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8.exe
Size

28KB
MD5

0cd8383539c1b90f7813a236b9af6da0
SHA1

bd9fe748c4046eea9ac05066903b71e196e38edc
SHA256

48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8
SHA512

ea2817663b4b333903767a2b06cbf24d6f8ca899deb7efbaff16173abefb3f54312639bac5a220a1227c1575d96d6519833b2002ad3561e7015d5c455276310b
SSDEEP

768:sQxKzynmJnHyAtKzCIFtZ+wmf1qoryWxfV+UHjst33:TxIySnHgz3/ZFo1V+tH

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
960	NTdHcP.exe

Loads dropped DLL 2 IoCs

pid	Process
1996	48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8.exe
1996	48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NTdHcP.exe	48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8.exe
File opened for modification	C:\Windows\SysWOW64\NTdHcP.exe	48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8.exe
File opened for modification	C:\Windows\SysWOW64\NTdHcP.exe	NTdHcP.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 960	1996	48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8.exe	27
PID 1996 wrote to memory of 960	1996	48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8.exe	27
PID 1996 wrote to memory of 960	1996	48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8.exe	27
PID 1996 wrote to memory of 960	1996	48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8.exe	27

C:\Users\Admin\AppData\Local\Temp\48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8.exe
"C:\Users\Admin\AppData\Local\Temp\48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\NTdHcP.exe
  C:\Windows\system32\NTdHcP.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\NTdHcP.exe

Filesize
28KB

MD5
0cd8383539c1b90f7813a236b9af6da0

SHA1
bd9fe748c4046eea9ac05066903b71e196e38edc

SHA256
48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8

SHA512
ea2817663b4b333903767a2b06cbf24d6f8ca899deb7efbaff16173abefb3f54312639bac5a220a1227c1575d96d6519833b2002ad3561e7015d5c455276310b

Download Submit
C:\Windows\SysWOW64\NTdHcP.exe

Filesize
28KB

MD5
0cd8383539c1b90f7813a236b9af6da0

SHA1
bd9fe748c4046eea9ac05066903b71e196e38edc

SHA256
48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8

SHA512
ea2817663b4b333903767a2b06cbf24d6f8ca899deb7efbaff16173abefb3f54312639bac5a220a1227c1575d96d6519833b2002ad3561e7015d5c455276310b

Download Submit
\Windows\SysWOW64\NTdHcP.exe

Filesize
28KB

MD5
0cd8383539c1b90f7813a236b9af6da0

SHA1
bd9fe748c4046eea9ac05066903b71e196e38edc

SHA256
48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8

SHA512
ea2817663b4b333903767a2b06cbf24d6f8ca899deb7efbaff16173abefb3f54312639bac5a220a1227c1575d96d6519833b2002ad3561e7015d5c455276310b

Download Submit
\Windows\SysWOW64\NTdHcP.exe

Filesize
28KB

MD5
0cd8383539c1b90f7813a236b9af6da0

SHA1
bd9fe748c4046eea9ac05066903b71e196e38edc

SHA256
48d5dcf9d0415d33dcb10035429799f318da31345bdd5034a9685a455f3f7fc8

SHA512
ea2817663b4b333903767a2b06cbf24d6f8ca899deb7efbaff16173abefb3f54312639bac5a220a1227c1575d96d6519833b2002ad3561e7015d5c455276310b

Download Submit
memory/960-62-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1996-54-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1996-61-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads