6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa

Analysis

max time kernel
44s
max time network
138s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 03:53

Target

6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa.exe
Size

92KB
MD5

7e81a6e26b610679c0e47a48345d2d00
SHA1

84af37c99fabe137e0de7287a0014693a3e85f02
SHA256

6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa
SHA512

8335d85335c4070cec324b5189841d4454d57eb5ad58598356cf06d86a1552a04c4bb6a31a1404a88a6d0bc0664a12826a1bceee6cf55f433eedd0dcbe7f57a1
SSDEEP

1536:8MaJfoHkt9dw5rRMVX5iJb/YL9TNchDC8i/pMGmmaKznbwXcP:BaJwHyer85CbAL9TNchRi/aGmbKkcP

Score

1^/10

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa.exe:Zone.Identifier	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1160	1288	6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa.exe	28
PID 1288 wrote to memory of 1160	1288	6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa.exe	28
PID 1288 wrote to memory of 1160	1288	6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa.exe	28
PID 1288 wrote to memory of 568	1288	6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa.exe	30
PID 1288 wrote to memory of 568	1288	6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa.exe	30
PID 1288 wrote to memory of 568	1288	6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa.exe	30

C:\Users\Admin\AppData\Local\Temp\6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa.exe
"C:\Users\Admin\AppData\Local\Temp\6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\system32\cmd.exe
  "cmd"
  2⤵
  - NTFS ADS
  PID:1160
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 500
  2⤵
  PID:568

C:\Users\Admin\AppData\Local\Temp\6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa.exe

Filesize
92KB

MD5
7e81a6e26b610679c0e47a48345d2d00

SHA1
84af37c99fabe137e0de7287a0014693a3e85f02

SHA256
6cc2399778d94e8569a4664b697262c8ec8d751dc4fd5d8313083ade32bc8ffa

SHA512
8335d85335c4070cec324b5189841d4454d57eb5ad58598356cf06d86a1552a04c4bb6a31a1404a88a6d0bc0664a12826a1bceee6cf55f433eedd0dcbe7f57a1

Download Submit
memory/568-59-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download
memory/1288-54-0x000007FEF31D0000-0x000007FEF3BF3000-memory.dmp

Filesize
10.1MB

Download
memory/1288-55-0x000007FEF15D0000-0x000007FEF2666000-memory.dmp

Filesize
16.6MB

Download
memory/1288-57-0x0000000000A96000-0x0000000000AB5000-memory.dmp

Filesize
124KB

Download
memory/1288-61-0x0000000000A96000-0x0000000000AB5000-memory.dmp

Filesize
124KB

Download