fd446e6a1cf9ef91bbf8633c5ea78c4aa4a29a7fda9b178d01dbf8f0570b527f

Analysis

max time kernel
241s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:11

Target

fd446e6a1cf9ef91bbf8633c5ea78c4aa4a29a7fda9b178d01dbf8f0570b527f.exe
Size

56KB
MD5

4ec16644ac1f13040a24af8b25b65b8f
SHA1

6d9cb6f7c06be8f728e30b22b13a8262beb4eb09
SHA256

fd446e6a1cf9ef91bbf8633c5ea78c4aa4a29a7fda9b178d01dbf8f0570b527f
SHA512

45ffead756501adb115d34d25b88023d96601468ef1d859490bef1fe5b6fa5dea538124d3c589e4531151dc2ca939574c64111ad8dd70cfceba2ceae8530cfc4
SSDEEP

1536:Oppht6MFI3w4VNYI06oofwfnikOsE/QTZ8LuEE3:OpxL+3PiLofnKE/QT6LuF3

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1572 cmd.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fd446e6a1cf9ef91bbf8633c5ea78c4aa4a29a7fda9b178d01dbf8f0570b527f.exe

pid process

432 fd446e6a1cf9ef91bbf8633c5ea78c4aa4a29a7fda9b178d01dbf8f0570b527f.exe

pid	process
1572	cmd.exe

pid	process
432	fd446e6a1cf9ef91bbf8633c5ea78c4aa4a29a7fda9b178d01dbf8f0570b527f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fd446e6a1cf9ef91bbf8633c5ea78c4aa4a29a7fda9b178d01dbf8f0570b527f.exe

description	pid	process	target process
PID 432 wrote to memory of 1572	432	fd446e6a1cf9ef91bbf8633c5ea78c4aa4a29a7fda9b178d01dbf8f0570b527f.exe	cmd.exe
PID 432 wrote to memory of 1572	432	fd446e6a1cf9ef91bbf8633c5ea78c4aa4a29a7fda9b178d01dbf8f0570b527f.exe	cmd.exe
PID 432 wrote to memory of 1572	432	fd446e6a1cf9ef91bbf8633c5ea78c4aa4a29a7fda9b178d01dbf8f0570b527f.exe	cmd.exe
PID 432 wrote to memory of 1572	432	fd446e6a1cf9ef91bbf8633c5ea78c4aa4a29a7fda9b178d01dbf8f0570b527f.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninst06f81af.bat" "C:\Users\Admin\AppData\Local\Temp\fd446e6a1cf9ef91bbf8633c5ea78c4aa4a29a7fda9b178d01dbf8f0570b527f.exe""
2⤵
- Deletes itself
PID:1572

C:\Users\Admin\AppData\Local\Temp\uninst06f81af.bat
Filesize
59B

MD5
2988b921fbed03f9c93c5d538932bbe3

SHA1
4b791b3d59ae76ff091c2cf201b40f5d1b432a3f

SHA256
a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3

SHA512
2920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9

Download Submit
memory/432-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/432-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/432-56-0x0000000000320000-0x0000000000332000-memory.dmp

Filesize
72KB

Download
memory/432-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1572-57-0x0000000000000000-mapping.dmp

Download