5f26ba6ce5a487a3c9ec7663143f6d661c5500d0dd593274bd4ab6e78815d236

Analysis

max time kernel
141s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-06-2023 11:30

Target

uiso9_pe.exe
Size

4.9MB
MD5

5a2000a241a6947c060ee63425d7ebef
SHA1

d80bbe4769b5e00886797d6f7c30063031eb5699
SHA256

5f26ba6ce5a487a3c9ec7663143f6d661c5500d0dd593274bd4ab6e78815d236
SHA512

cf4155b56d878d1d4c8b18669d6aa700c626fa5b2f67719bb8b2f8378059003046f437ae223a7aef6336d95cb82eeeb057910a432c135bbc4d94619a8bbfde1a
SSDEEP

98304:JUj8/4MycvvCf9uOj5zXSdcrRsMZtuS0xbN0yjqnolKIMPgZrx/CpSSMD/zCDK8:Oj3MychOBXSdclsotcYyEGMPqrxo0zCP

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
1688	uiso9_pe.tmp

Loads dropped DLL 1 IoCs

pid	Process
1456	uiso9_pe.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1688	1456	uiso9_pe.exe	28
PID 1456 wrote to memory of 1688	1456	uiso9_pe.exe	28
PID 1456 wrote to memory of 1688	1456	uiso9_pe.exe	28
PID 1456 wrote to memory of 1688	1456	uiso9_pe.exe	28
PID 1456 wrote to memory of 1688	1456	uiso9_pe.exe	28
PID 1456 wrote to memory of 1688	1456	uiso9_pe.exe	28
PID 1456 wrote to memory of 1688	1456	uiso9_pe.exe	28

C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe
"C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Local\Temp\is-UQLV6.tmp\uiso9_pe.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UQLV6.tmp\uiso9_pe.tmp" /SL5="$70126,4629041,128512,C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"
  2⤵
  - Executes dropped EXE
  PID:1688

C:\Users\Admin\AppData\Local\Temp\is-UQLV6.tmp\uiso9_pe.tmp

Filesize
771KB

MD5
3de2992c86c78e781881e9c0db26a32f

SHA1
c26845ca7319a66432304a955cecdad4f977d040

SHA256
e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642

SHA512
88d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6

Download Submit
\Users\Admin\AppData\Local\Temp\is-UQLV6.tmp\uiso9_pe.tmp

Filesize
771KB

MD5
3de2992c86c78e781881e9c0db26a32f

SHA1
c26845ca7319a66432304a955cecdad4f977d040

SHA256
e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642

SHA512
88d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6

Download Submit
memory/1456-54-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1456-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1688-62-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1688-64-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download