32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52

Analysis

max time kernel
54s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:39

Target

32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe
Size

725KB
MD5

8635663044bfaedb51f2e804712456bd
SHA1

f88a26dc55f609adaa19ad29a97db25d3911f8aa
SHA256

32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52
SHA512

a23265bc76a356044a4546be964a8e772b05a0a680856a4b6ab2681c1c16fff245936107cd49c25d24369cd11e608cb5d2e22a43655ed29f3ea9a56d39fc18fc
SSDEEP

12288:ubnrXLD7m/QmIT/yuPH+7kuffOnveHw0ARexgIHfRcCOi1:O7fmEPH+7VnOWH3JqCOi1

Score

8^/10

Executes dropped EXE 2 IoCs

Processes:

ZZND3ODBWIOUDGBW9IDGW3IDGDZZND3ODBWIOUDGBW9IDGW3IDGD

pid process

1972 ZZND3ODBWIOUDGBW9IDGW3IDGD
1624 ZZND3ODBWIOUDGBW9IDGW3IDGD
Deletes itself 1 IoCs

Processes:

ZZND3ODBWIOUDGBW9IDGW3IDGD

pid process

1624 ZZND3ODBWIOUDGBW9IDGW3IDGD

pid	process
1972	ZZND3ODBWIOUDGBW9IDGW3IDGD
1624	ZZND3ODBWIOUDGBW9IDGW3IDGD

pid	process
1624	ZZND3ODBWIOUDGBW9IDGW3IDGD

Drops startup file 1 IoCs

Processes:

32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZZH83DHO932BDOG928G3FBD2ODH.vbs	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe

Loads dropped DLL 1 IoCs

Processes:

32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe

pid process

1716 32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe

pid	process
1716	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exeZZND3ODBWIOUDGBW9IDGW3IDGD

description	pid	process	target process
PID 1716 wrote to memory of 1972	1716	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 1716 wrote to memory of 1972	1716	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 1716 wrote to memory of 1972	1716	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 1716 wrote to memory of 1972	1716	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 1716 wrote to memory of 1624	1716	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 1716 wrote to memory of 1624	1716	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 1716 wrote to memory of 1624	1716	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 1716 wrote to memory of 1624	1716	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 1972 wrote to memory of 800	1972	ZZND3ODBWIOUDGBW9IDGW3IDGD	iexplore.exe
PID 1972 wrote to memory of 800	1972	ZZND3ODBWIOUDGBW9IDGW3IDGD	iexplore.exe
PID 1972 wrote to memory of 800	1972	ZZND3ODBWIOUDGBW9IDGW3IDGD	iexplore.exe
PID 1972 wrote to memory of 800	1972	ZZND3ODBWIOUDGBW9IDGW3IDGD	iexplore.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:800

C:\Users\Admin\AppData\Roaming\ZZND3ODBWIOUDGBW9IDGW3IDGD

Filesize
725KB

MD5
8635663044bfaedb51f2e804712456bd

SHA1
f88a26dc55f609adaa19ad29a97db25d3911f8aa

SHA256
32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52

SHA512
a23265bc76a356044a4546be964a8e772b05a0a680856a4b6ab2681c1c16fff245936107cd49c25d24369cd11e608cb5d2e22a43655ed29f3ea9a56d39fc18fc

Download Submit
C:\Users\Admin\AppData\Roaming\ZZND3ODBWIOUDGBW9IDGW3IDGD

Filesize
725KB

MD5
8635663044bfaedb51f2e804712456bd

SHA1
f88a26dc55f609adaa19ad29a97db25d3911f8aa

SHA256
32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52

SHA512
a23265bc76a356044a4546be964a8e772b05a0a680856a4b6ab2681c1c16fff245936107cd49c25d24369cd11e608cb5d2e22a43655ed29f3ea9a56d39fc18fc

Download Submit
\Users\Admin\AppData\Roaming\ZZND3ODBWIOUDGBW9IDGW3IDGD

Filesize
725KB

MD5
8635663044bfaedb51f2e804712456bd

SHA1
f88a26dc55f609adaa19ad29a97db25d3911f8aa

SHA256
32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52

SHA512
a23265bc76a356044a4546be964a8e772b05a0a680856a4b6ab2681c1c16fff245936107cd49c25d24369cd11e608cb5d2e22a43655ed29f3ea9a56d39fc18fc

Download Submit
memory/1624-58-0x0000000000000000-mapping.dmp

Download
memory/1716-54-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x0000000000000000-mapping.dmp

Download