21d51bd42c810c6a2e1d047c789003d2ba3c75de557e1f2fd199f423d0a2d3f2

Analysis

max time kernel
55s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 14:07

Target

21d51bd42c810c6a2e1d047c789003d2ba3c75de557e1f2fd199f423d0a2d3f2.exe
Size

39KB
MD5

1127ce8efbeb3ec630f6e07573a9cf98
SHA1

8ba2ffc38c9f52b50298e17437be76ae250a7905
SHA256

21d51bd42c810c6a2e1d047c789003d2ba3c75de557e1f2fd199f423d0a2d3f2
SHA512

1c3905023ad1b9ea2f06a79a7e59ace86b42ca0c860766050a22961ade47379f63d685564f8809a0d1bd5e73e449a1f70fff9bda85040e7a0d4f301fd2e2854f
SSDEEP

768:xYpw78Ac0AtebJzHeCAZfw3IbPhiw3aLa7EiifrB:xIEpZzHTAZ4YbPGa7EiifV

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1972	sxeDC3C.tmp

Loads dropped DLL 2 IoCs

pid	Process
1992	21d51bd42c810c6a2e1d047c789003d2ba3c75de557e1f2fd199f423d0a2d3f2.exe
1992	21d51bd42c810c6a2e1d047c789003d2ba3c75de557e1f2fd199f423d0a2d3f2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1972	1992	21d51bd42c810c6a2e1d047c789003d2ba3c75de557e1f2fd199f423d0a2d3f2.exe	28
PID 1992 wrote to memory of 1972	1992	21d51bd42c810c6a2e1d047c789003d2ba3c75de557e1f2fd199f423d0a2d3f2.exe	28
PID 1992 wrote to memory of 1972	1992	21d51bd42c810c6a2e1d047c789003d2ba3c75de557e1f2fd199f423d0a2d3f2.exe	28
PID 1992 wrote to memory of 1972	1992	21d51bd42c810c6a2e1d047c789003d2ba3c75de557e1f2fd199f423d0a2d3f2.exe	28

C:\Users\Admin\AppData\Local\Temp\21d51bd42c810c6a2e1d047c789003d2ba3c75de557e1f2fd199f423d0a2d3f2.exe
"C:\Users\Admin\AppData\Local\Temp\21d51bd42c810c6a2e1d047c789003d2ba3c75de557e1f2fd199f423d0a2d3f2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\sxeDC3C.tmp
  "C:\Users\Admin\AppData\Local\Temp\sxeDC3C.tmp"
  2⤵
  - Executes dropped EXE
  PID:1972

C:\Users\Admin\AppData\Local\Temp\sxeDC3C.tmp

Filesize
52KB

MD5
fe74e6d1161e03e10306c256a461b71a

SHA1
824c38d965e16e80388402a1f1af6d0cabd8a488

SHA256
6b6e9154a726c09ff6830a532a2b310e44896321cf45abfc162ad6e9b56e7bff

SHA512
923e41a2514d51f2726169e823bdea7a15bd0bf42d8bb44ae5c92d770c6d41953d7a444e72f2074ef625e084b0afbd9eabaf90e23769114d6760779b816611a9

Download Submit
\Users\Admin\AppData\Local\Temp\sxeDC3C.tmp

Filesize
52KB

MD5
fe74e6d1161e03e10306c256a461b71a

SHA1
824c38d965e16e80388402a1f1af6d0cabd8a488

SHA256
6b6e9154a726c09ff6830a532a2b310e44896321cf45abfc162ad6e9b56e7bff

SHA512
923e41a2514d51f2726169e823bdea7a15bd0bf42d8bb44ae5c92d770c6d41953d7a444e72f2074ef625e084b0afbd9eabaf90e23769114d6760779b816611a9

Download Submit
\Users\Admin\AppData\Local\Temp\sxeDC3C.tmp

Filesize
52KB

MD5
fe74e6d1161e03e10306c256a461b71a

SHA1
824c38d965e16e80388402a1f1af6d0cabd8a488

SHA256
6b6e9154a726c09ff6830a532a2b310e44896321cf45abfc162ad6e9b56e7bff

SHA512
923e41a2514d51f2726169e823bdea7a15bd0bf42d8bb44ae5c92d770c6d41953d7a444e72f2074ef625e084b0afbd9eabaf90e23769114d6760779b816611a9

Download Submit
memory/1972-58-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download