224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 03:34

Target

224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe
Size

1.7MB
MD5

2389f8e6150d582831bc4f689dfdffb0
SHA1

69bddd958d93fa2ff666b3ce3249339380ae3ce7
SHA256

224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c
SHA512

9f5db9b5a0bf2bb066ac018cfa3a6066f3dbebf28dde46c17456c4b1a70c4568753e65ee501c0c3542d8bb5cb8926d36354b10a7f42f0b9dbda6a69e3755da83
SSDEEP

24576:lVSL6ZcViR7SVLppwidNf0S3ei3832FAd60IB7wgU8PtCG8Slw4HvVWv:b92w0VLppwidOS3eJ2w6t1H9feU9W

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1120	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1480	224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1120	1480	224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe	30
PID 1480 wrote to memory of 1120	1480	224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe	30
PID 1480 wrote to memory of 1120	1480	224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe	30
PID 1480 wrote to memory of 1120	1480	224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe	30

C:\Users\Admin\AppData\Local\Temp\224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe
"C:\Users\Admin\AppData\Local\Temp\224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\_tmpxqr.bat"
  2⤵
  - Deletes itself
  PID:1120

C:\Users\Admin\AppData\Roaming\_tmpxqr.bat

Filesize
200B

MD5
d0971b21bcbfd34afdde1fd168f0204e

SHA1
64c738c3ceff7ba7ee2430d69ab75425e34dbbb8

SHA256
ae5bbbd9000403344fb0f8b49e405ce8351bdb67a9aefbb947930470a90eab37

SHA512
3b19d82e7c2931792e3657e38b09d8830fe9044a9c3a714dc7ebdd3c4de4458c63284563b3734ec741e88f84d85f162189f3bfa9e987c389aaad6a8aa47dc312

Download Submit
memory/1480-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1480-55-0x0000000000A90000-0x0000000000B14000-memory.dmp

Filesize
528KB

Download
memory/1480-56-0x0000000000C60000-0x0000000000E19000-memory.dmp

Filesize
1.7MB

Download
memory/1480-59-0x0000000000C60000-0x0000000000E19000-memory.dmp

Filesize
1.7MB

Download