8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3

Analysis

max time kernel
26s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 18:32

Target

8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3.exe
Size

68KB
MD5

74d465b284ddbfbd7ee815ddfc917663
SHA1

2d935c2a4cc8134003653f662a0af92674df475d
SHA256

8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3
SHA512

123e203e70a64fa31b65a28b188235435254eb7d9f45d3c19ec79131bfee2f0ab4e925d00819b1082d8d22200d4efc57e34b81bca1c8c755386ed971d6e3fa6f
SSDEEP

768:K8EyXFiQOgFpSafqnlZQBISf968C36JpW:K8fIWfKiISf96qpW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1920	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\del.bat	8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1920	1932	8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3.exe	28
PID 1932 wrote to memory of 1920	1932	8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3.exe	28
PID 1932 wrote to memory of 1920	1932	8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3.exe	28
PID 1932 wrote to memory of 1920	1932	8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3.exe	28
PID 1932 wrote to memory of 1920	1932	8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3.exe	28
PID 1932 wrote to memory of 1920	1932	8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3.exe	28
PID 1932 wrote to memory of 1920	1932	8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3.exe	28

C:\Users\Admin\AppData\Local\Temp\8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3.exe
"C:\Users\Admin\AppData\Local\Temp\8ecbb03d5fc7c11314105f6e4fea764aec93e4f361a7c2abd4f5ff8a7e0a34c3.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\del.bat
  2⤵
  - Deletes itself
  PID:1920

C:\Windows\SysWOW64\del.bat

Filesize
284B

MD5
70af6319a3614d2f5395f24cecbff2ae

SHA1
1a8796aca62fe94c6fdcd064fecc99adfed04ba3

SHA256
c170450b1847b014d0f4c299c91f265b0125405db951b381df178e0909645636

SHA512
0dc5aa8e31570021364c3214acc4c49a346f0b2ac89cd0681ae5fb0e09b8700c8803ea14f4e3488efff68b6502c89970b8e5f5fbbe554fd4ed83255850b20f5a

Download Submit
memory/1932-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download