937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4

Analysis

max time kernel
82s
max time network
110s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 03:19

Target

937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4.exe
Size

1.0MB
MD5

e67c82e53e874b163e7237838a25b8f9
SHA1

4486ffbfde2f16a27ea40c9e8c7e77a4508d65fe
SHA256

937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4
SHA512

cb2c3a4d4c79bb30d31bfae91d68e3aaf290b6f306d224a7cbe2102e8effa837253f78f513a54476a7975501aa71f6439607c8ca5d862bf27e9689476379f68e
SSDEEP

12288:ANMheRpeY/Nbke+Ev+ZqUHW+s/kKbvRBK8YmscT2CEvMYm17KqU0mJHbLv3AM+Pf:uMhSpJ/+Zq5Q+T/YLmO7LYB646y

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1332 cmd.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4.exe

pid process

2036 937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4.exe

pid	process
1332	cmd.exe

pid	process
2036	937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4.exe

description	pid	process	target process
PID 2036 wrote to memory of 1332	2036	937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4.exe	cmd.exe
PID 2036 wrote to memory of 1332	2036	937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4.exe	cmd.exe
PID 2036 wrote to memory of 1332	2036	937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4.exe	cmd.exe
PID 2036 wrote to memory of 1332	2036	937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4.exe
"C:\Users\Admin\AppData\Local\Temp\937650fddf313ae3ef708ae9c7d9a817fc59224f609764b6e81caafadb053da4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\84KJJB~1.BAT"
  2⤵
  - Deletes itself
  PID:1332

C:\Users\Admin\AppData\Roaming\84kJjbdJDHqw48.bat

Filesize
201B

MD5
163045fb71f926308818cd4d46895b65

SHA1
b112693074fd36ec8b5ba3c572357a133014aff2

SHA256
753311323819db98c0a0fd6e41c8d1fa79dc058d883f92580dca5b66d85a1b96

SHA512
b91b8399ee3bf2f7fc07a8afdb1e321e059f1a9104e678b6700f6d3c35f523a78fc43a1155504477032f3a1deaaddbcd533f45cd297360156addb8bdd1ca873a

Download Submit
memory/1332-58-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/2036-55-0x00000000002D0000-0x00000000003AF000-memory.dmp

Filesize
892KB

Download
memory/2036-56-0x0000000000400000-0x00000000005DA000-memory.dmp

Filesize
1.9MB

Download
memory/2036-57-0x0000000000400000-0x00000000005DA000-memory.dmp

Filesize
1.9MB

Download
memory/2036-59-0x0000000000400000-0x00000000005DA000-memory.dmp

Filesize
1.9MB

Download