5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907

Analysis

max time kernel
106s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 08:50

Target

5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907.exe
Size

96KB
MD5

40f74ea337918dde6da0497d064bc02b
SHA1

a461d82ef9de1c54a7d55125ecca8bfac3322727
SHA256

5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907
SHA512

f54211f68e96233193d5ec7ea238b4199adc60f1f95caf971c5cf6bfebdb47c7f4d74a0f8b54b7165911ab3e7645eabec599ebce2c80cdd75adb716e994f0b5c
SSDEEP

1536:MJFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prMmdIUYG:MfS4jHS8q/3nTzePCwNUh4E9MmdIjG

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1372	fjyyigryuy

Loads dropped DLL 2 IoCs

pid	Process
1044	5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907.exe
1044	5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1372	1044	5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907.exe	27
PID 1044 wrote to memory of 1372	1044	5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907.exe	27
PID 1044 wrote to memory of 1372	1044	5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907.exe	27
PID 1044 wrote to memory of 1372	1044	5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907.exe	27

C:\Users\Admin\AppData\Local\Temp\5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907.exe
"C:\Users\Admin\AppData\Local\Temp\5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044
- \??\c:\users\admin\appdata\local\fjyyigryuy
  "C:\Users\Admin\AppData\Local\Temp\5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907.exe" a -sc:\users\admin\appdata\local\temp\5b996076e9ad39075e206bc982ec6d3bacf2fb6ce7512c79d0aa7016e0093907.exe
  2⤵
  - Executes dropped EXE
  PID:1372

C:\Users\Admin\AppData\Local\fjyyigryuy

Filesize
23.4MB

MD5
5f4a1e0446963502b0c115b3e467a74f

SHA1
563a68052fb5361bb0bdc7b4188768cdfc5644dc

SHA256
a7ac90e9e5f0945c0cf0357ef6d98b03f6b67114aa6501f3f02683b5df3ff7fb

SHA512
20f6974aa85da2fa156eebbbb8ddc8f424531eb1602560fe417c44a49069a6d3ab1d6209071a0d4142057637cf5fd3df962d6b0622ce459e3ddf37787c2d9b84

Download Submit
\Users\Admin\AppData\Local\fjyyigryuy

Filesize
23.4MB

MD5
5f4a1e0446963502b0c115b3e467a74f

SHA1
563a68052fb5361bb0bdc7b4188768cdfc5644dc

SHA256
a7ac90e9e5f0945c0cf0357ef6d98b03f6b67114aa6501f3f02683b5df3ff7fb

SHA512
20f6974aa85da2fa156eebbbb8ddc8f424531eb1602560fe417c44a49069a6d3ab1d6209071a0d4142057637cf5fd3df962d6b0622ce459e3ddf37787c2d9b84

Download Submit
\Users\Admin\AppData\Local\fjyyigryuy

Filesize
23.4MB

MD5
5f4a1e0446963502b0c115b3e467a74f

SHA1
563a68052fb5361bb0bdc7b4188768cdfc5644dc

SHA256
a7ac90e9e5f0945c0cf0357ef6d98b03f6b67114aa6501f3f02683b5df3ff7fb

SHA512
20f6974aa85da2fa156eebbbb8ddc8f424531eb1602560fe417c44a49069a6d3ab1d6209071a0d4142057637cf5fd3df962d6b0622ce459e3ddf37787c2d9b84

Download Submit
memory/1044-54-0x0000000000400000-0x000000000044E334-memory.dmp

Filesize
312KB

Download
memory/1044-55-0x0000000000400000-0x000000000044E334-memory.dmp

Filesize
312KB

Download
memory/1372-60-0x0000000000400000-0x000000000044E334-memory.dmp

Filesize
312KB

Download
memory/1372-61-0x0000000000400000-0x000000000044E334-memory.dmp

Filesize
312KB

Download