ef85cbb5f5bdcd6ccbf87215411ca2ac8b0432b248668db03dcb9c3fe53b2561

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 10:46

Target

0c2f6769d0768ec720ae27a7f2f1ff06.exe
Size

3.1MB
MD5

0c2f6769d0768ec720ae27a7f2f1ff06
SHA1

dd0ac92a2469db77758c26df210f73840176871d
SHA256

ef85cbb5f5bdcd6ccbf87215411ca2ac8b0432b248668db03dcb9c3fe53b2561
SHA512

53b3c4c2e906b264c7700ea7fdf5b77a4eafe2a838a46fd10f2921e5ea9ce0760ec603035ab96369e12be24c340136b43843e29d9ec767ad1179eec6ff3b0c7d
SSDEEP

98304:5mSWOiIyUo9qnLE3AHxVt7fR1ySchkGluyuAVLUjH5oxFbxx:5XCkLE3AR/fqNhtluyuAVUjZEdx

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2348	477C.tmp

Loads dropped DLL 1 IoCs

pid	Process
1876	0c2f6769d0768ec720ae27a7f2f1ff06.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2348	1876	0c2f6769d0768ec720ae27a7f2f1ff06.exe	28
PID 1876 wrote to memory of 2348	1876	0c2f6769d0768ec720ae27a7f2f1ff06.exe	28
PID 1876 wrote to memory of 2348	1876	0c2f6769d0768ec720ae27a7f2f1ff06.exe	28
PID 1876 wrote to memory of 2348	1876	0c2f6769d0768ec720ae27a7f2f1ff06.exe	28

C:\Users\Admin\AppData\Local\Temp\0c2f6769d0768ec720ae27a7f2f1ff06.exe
"C:\Users\Admin\AppData\Local\Temp\0c2f6769d0768ec720ae27a7f2f1ff06.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\477C.tmp
  "C:\Users\Admin\AppData\Local\Temp\477C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\0c2f6769d0768ec720ae27a7f2f1ff06.exe 010F122A42299D17F49D9EFE2FFE49C6C9372B5A6925581964BEA643964CAE0D8A6B580E208EC36E37B7BA1ADDE068C2CA4754A48233256424D340D7391E5792
  2⤵
  - Executes dropped EXE
  PID:2348

\Users\Admin\AppData\Local\Temp\477C.tmp

Filesize
3.1MB

MD5
fa99dfc0a39cb3a4bea27613ea0f8cae

SHA1
aa9748af715e127756e8894d208d3d082c2da57d

SHA256
48a6f2fa6e811675f99fa0a8a006a0236608ba42cea1e75a2363916dc96742bb

SHA512
ea0cc576960645d89380226c3a7ad46aaa9bb6dbe72862d39c36d2dc3e494136d884d0b8ff2e858507b3992fc6a33ec89a3d9b6f8dfdfd828059f4b2eae110a4

Download Submit
memory/1876-0-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2348-6-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download