1974f6270fde1b98f44d790fbad36f39c8b05906e2c52ce6e013fadba55e728f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:44

Target

dead0c1caf99a765358fcdf577c248d5.exe
Size

809KB
MD5

dead0c1caf99a765358fcdf577c248d5
SHA1

fc4ee86bc4876254d0d7a50523480e1ab7afb34d
SHA256

1974f6270fde1b98f44d790fbad36f39c8b05906e2c52ce6e013fadba55e728f
SHA512

5745739d779d01b81dfa7566acc5f4632f08d61e69f1c74790c03aed32fca3ca01a0e2c00270e142a0cff0c39e8b1cb46dbd05df1bb6991a8bf0de4da8aab66f
SSDEEP

12288:MLry/neyx7f/A64j7P+tixhT8n3qBmc1YkVYBDP5vaoDiOVJfBH1TB4WDi:qKeyxTAJj7P+yW6mc1YXvaoOS5Bi

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2008	m.exe

Loads dropped DLL 1 IoCs

pid	Process
2004	dead0c1caf99a765358fcdf577c248d5.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ifcekjjv\m.exe	dead0c1caf99a765358fcdf577c248d5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2008	2004	dead0c1caf99a765358fcdf577c248d5.exe	17
PID 2004 wrote to memory of 2008	2004	dead0c1caf99a765358fcdf577c248d5.exe	17
PID 2004 wrote to memory of 2008	2004	dead0c1caf99a765358fcdf577c248d5.exe	17
PID 2004 wrote to memory of 2008	2004	dead0c1caf99a765358fcdf577c248d5.exe	17

C:\Users\Admin\AppData\Local\Temp\dead0c1caf99a765358fcdf577c248d5.exe
"C:\Users\Admin\AppData\Local\Temp\dead0c1caf99a765358fcdf577c248d5.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\ifcekjjv\m.exe
  "C:\Program Files (x86)\ifcekjjv\m.exe"
  2⤵
  - Executes dropped EXE
  PID:2008

C:\Program Files (x86)\ifcekjjv\m.exe

Filesize
129KB

MD5
b36c9e8026b5119a267d1ddc22ec12be

SHA1
cc6f3b96dd727db512d96a7033f0cd76122b8ccb

SHA256
0921ca7a4df5451d446fd439817b8fb9c002cab44f64dd3da7f3f7f8dbc9df0a

SHA512
e2b69cfac1a73d61ac0e3cba47185ba9326b7a4a08beec2fdcf90bbc7d99fb7afd281eaacbbdfad7b6570d377c8abde88273296c3e1f69ae5d820208aed07f89

Download Submit
\Program Files (x86)\ifcekjjv\m.exe

Filesize
146KB

MD5
67d454d3725b7f1fb177fbbd7f52e0f5

SHA1
6405e8bc4c7476f77996826aece8ccc2d6c33040

SHA256
60e737059fb89e49764d5700470f537a8617365acfd9e00b5a58aa9f5dabd696

SHA512
b6ae641d5b9b878534ce819aa449941e0f14d858b7cb68d50cdafe5e2ec1c304f88586dc486a2548502372b3b30dc9b625b9531e3fbe2907ffbc8aba8cd7d993

Download Submit
memory/2004-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2004-6-0x0000000000330000-0x00000000003C4000-memory.dmp

Filesize
592KB

Download
memory/2004-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2004-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2008-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2008-11-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download