97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1

Analysis

max time kernel
47s
max time network
70s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 06:27

Target

97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe
Size

732KB
MD5

528fe44cdf6d496b1c5d03b501845df3
SHA1

ed2378b13912beab3d73961f0b5485bd3e391c85
SHA256

97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1
SHA512

1fe849a061d82eae94c887fb2630c1446c9792f060cf988cb250a50da67b979dc3aa7a559b7ef72037bd6f7787f71bec3d9f0f512882fdd93f7c2f9e99ece23b
SSDEEP

12288:3+R9FGm7wT+j2uoGKPfVQIk9lS7+smzjugzaFtoteAXKzkN9O6qhTopxxh:OzPHChXVQpSmzSg2lbzkHj6Tov

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1132	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\223d948375.dll	97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1132	1668	97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe	31
PID 1668 wrote to memory of 1132	1668	97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe	31
PID 1668 wrote to memory of 1132	1668	97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe	31
PID 1668 wrote to memory of 1132	1668	97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe	31

C:\Users\Admin\AppData\Local\Temp\97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe
"C:\Users\Admin\AppData\Local\Temp\97cefa3d03a0007fc03d65ec0bd7ed5489b77e00ffa26586ad2765f63b5393e1.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$30689.bat
  2⤵
  - Deletes itself
  PID:1132

C:\Users\Admin\AppData\Local\Temp\$$30689.bat

Filesize
181B

MD5
05e0ecfce889ea0154c1e11945509901

SHA1
adc724db4ab5a6ad5f7b39e80feb50b7b45cc4f9

SHA256
39febb0a278deb8606f81cafb6fc636b7b4f57449b9e1ef36e228867eb3ce2a3

SHA512
2947b0f8089c4321cd26192d4d2da321ae47ffac36e0711f69bb9ccbaf12117a31260575927b018b7439390878f0a9ac3cc6a2e3dd37f09d4f20bd9a4969da90

Download Submit
memory/1668-54-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1668-55-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/1668-56-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download
memory/1668-58-0x0000000013140000-0x00000000131F7000-memory.dmp

Filesize
732KB

Download