cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 19:55

Target

cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe
Size

76KB
MD5

26766183d64b3b75ce323258e9fda7cb
SHA1

12fc16380f4b7a2ce13dce2438357d8f2c966ce5
SHA256

cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a
SHA512

e96c602fe1bbca9ecf8d50163acdb9824c930fd08556910b9e82bdfa569289c2d781e4cd18c4eaac3f7925365b5c010c15298997bde5c339238d55b0fe805dea
SSDEEP

1536:sBbjylfnjG4pOOHYB36XwO0HzZC9Ji0w6S/eUv8BtrTKvoPOOAWp:kkfEaYFodS1vCbPvAWp

Score

8^/10

evasion

Deletes itself 1 IoCs

pid	Process
556	cmd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
308	cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 308	1308	cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe	27
PID 1308 wrote to memory of 308	1308	cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe	27
PID 1308 wrote to memory of 308	1308	cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe	27
PID 1308 wrote to memory of 308	1308	cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe	27
PID 308 wrote to memory of 556	308	cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe	28
PID 308 wrote to memory of 556	308	cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe	28
PID 308 wrote to memory of 556	308	cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe	28
PID 308 wrote to memory of 556	308	cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe	28

C:\Users\Admin\AppData\Local\Temp\cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe
"C:\Users\Admin\AppData\Local\Temp\cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe
  "C:\Users\Admin\AppData\Local\Temp\cf231c665bd598392a1e7f33a187f2f52eb502ef76bc60256b3a8069bc249f1a.exe" del
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Windows\SysWOW64\cmd.exe
    /c del C:\Users\Admin\AppData\Local\Temp\CF231C~1.EXE.tmp >> NUL
    3⤵
    - Deletes itself
    PID:556