41a6c0ca811d683d5c4c94d8c5611420b9c4e635398bbd116b845ada9f7cdb3d

Analysis

max time kernel
132s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 04:52

Target

41a6c0ca811d683d5c4c94d8c5611420b9c4e635398bbd116b845ada9f7cdb3d.exe
Size

32KB
MD5

f770cb1272101345f8c040dd4714ac37
SHA1

50387d97ddfdbe605a085226403f873af4fbd71f
SHA256

41a6c0ca811d683d5c4c94d8c5611420b9c4e635398bbd116b845ada9f7cdb3d
SHA512

d7936a0aaaab57e1d0bf63b7e6930bb745d55963411bda992e384121c0804cf13ba98c11cca0cbcdb707faa94dc667fb1f56013655ccc561edf3a77e7963785b
SSDEEP

768:IZ71cnyyM4AaX80naUU5Zj0taG4KKUzNd:871ETKsDnAS4KpNd

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3544	docviewer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 3544	2952	41a6c0ca811d683d5c4c94d8c5611420b9c4e635398bbd116b845ada9f7cdb3d.exe	80
PID 2952 wrote to memory of 3544	2952	41a6c0ca811d683d5c4c94d8c5611420b9c4e635398bbd116b845ada9f7cdb3d.exe	80
PID 2952 wrote to memory of 3544	2952	41a6c0ca811d683d5c4c94d8c5611420b9c4e635398bbd116b845ada9f7cdb3d.exe	80

C:\Users\Admin\AppData\Local\Temp\41a6c0ca811d683d5c4c94d8c5611420b9c4e635398bbd116b845ada9f7cdb3d.exe
"C:\Users\Admin\AppData\Local\Temp\41a6c0ca811d683d5c4c94d8c5611420b9c4e635398bbd116b845ada9f7cdb3d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Users\Admin\AppData\Local\Temp\docviewer.exe
  C:\Users\Admin\AppData\Local\Temp\docviewer.exe
  2⤵
  - Executes dropped EXE
  PID:3544

C:\Users\Admin\AppData\Local\Temp\docA397.txt

Filesize
206B

MD5
ff5268296c941985eb15360c533d6439

SHA1
5826731398662726f6fe3347ce47780828babe58

SHA256
f48eaa7fcd0d83fc074dceafc60ab7c60bf7e7a76bf00162d774b14a8d69a4e4

SHA512
03ecea7a4c84dc3be5635d0459fc39874548b0145946bf13250fbdf2d55d8704fec7269223ec23b3b63237082ddee8dd315a871691929c93f17f49cbf126e82a

Download Submit
C:\Users\Admin\AppData\Local\Temp\docviewer.exe

Filesize
32KB

MD5
f770cb1272101345f8c040dd4714ac37

SHA1
50387d97ddfdbe605a085226403f873af4fbd71f

SHA256
41a6c0ca811d683d5c4c94d8c5611420b9c4e635398bbd116b845ada9f7cdb3d

SHA512
d7936a0aaaab57e1d0bf63b7e6930bb745d55963411bda992e384121c0804cf13ba98c11cca0cbcdb707faa94dc667fb1f56013655ccc561edf3a77e7963785b

Download Submit
C:\Users\Admin\AppData\Local\Temp\docviewer.exe

Filesize
32KB

MD5
f770cb1272101345f8c040dd4714ac37

SHA1
50387d97ddfdbe605a085226403f873af4fbd71f

SHA256
41a6c0ca811d683d5c4c94d8c5611420b9c4e635398bbd116b845ada9f7cdb3d

SHA512
d7936a0aaaab57e1d0bf63b7e6930bb745d55963411bda992e384121c0804cf13ba98c11cca0cbcdb707faa94dc667fb1f56013655ccc561edf3a77e7963785b

Download Submit
memory/2952-135-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3544-132-0x0000000000000000-mapping.dmp

Download
memory/3544-137-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download