8dce833d9f135bc5d381217bd8e7390464bd18032214d8427186db7a505cf5c0

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:04

Target

0fa2c32060eebf4377b7c812bcd06e2c.exe
Size

49KB
MD5

0fa2c32060eebf4377b7c812bcd06e2c
SHA1

77b38d635963bd065fe8f4db5339fe15b47846a7
SHA256

8dce833d9f135bc5d381217bd8e7390464bd18032214d8427186db7a505cf5c0
SHA512

299e8535e591d5ffc7fa22d475f80a383c2d03d3de11ab1b5d34a39890c0754a4de5c0d43ef6cb4ad2eddc15b13426346fbbb371784b667c617c133c9b290f58
SSDEEP

768:mCau1g2Jb8lFDKcQFWGYjcHvYO52OGnuh//HwT0+rYl2SjD943HGWX:mCau1TWflGjAO56e5uHh

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2296	cmd.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	204.117.214.10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\icf.exe	0fa2c32060eebf4377b7c812bcd06e2c.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe:exe.exe	0fa2c32060eebf4377b7c812bcd06e2c.exe
File created	C:\Windows\SysWOW64\icf.exe	0fa2c32060eebf4377b7c812bcd06e2c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2300 set thread context of 2324	2300	0fa2c32060eebf4377b7c812bcd06e2c.exe	16

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2324	2300	0fa2c32060eebf4377b7c812bcd06e2c.exe	16
PID 2300 wrote to memory of 2324	2300	0fa2c32060eebf4377b7c812bcd06e2c.exe	16
PID 2300 wrote to memory of 2324	2300	0fa2c32060eebf4377b7c812bcd06e2c.exe	16
PID 2300 wrote to memory of 2324	2300	0fa2c32060eebf4377b7c812bcd06e2c.exe	16
PID 2300 wrote to memory of 2324	2300	0fa2c32060eebf4377b7c812bcd06e2c.exe	16
PID 2300 wrote to memory of 2296	2300	0fa2c32060eebf4377b7c812bcd06e2c.exe	18
PID 2300 wrote to memory of 2296	2300	0fa2c32060eebf4377b7c812bcd06e2c.exe	18
PID 2300 wrote to memory of 2296	2300	0fa2c32060eebf4377b7c812bcd06e2c.exe	18
PID 2300 wrote to memory of 2296	2300	0fa2c32060eebf4377b7c812bcd06e2c.exe	18

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2228227.bat
1⤵
- Deletes itself
PID:2296

C:\Users\Admin\AppData\Local\Temp\2228227.bat

Filesize
235B

MD5
a3c67672b5f7762c573b080d89e7a15e

SHA1
fefae36e93348cbc917d790d16b1dad58962db95

SHA256
7a75ddea6727a4400178f38a73e1ff9e94f5df2e259c808c327b64dfd5a3adac

SHA512
89224344097bad4baf9c6ae542ca5120597aefef92384ed935430b8f9128bea449a0671b63426e9c295e0b8d0f2e965019a957c1bdc5b124ea8586ff53c8a79d

Download Submit
memory/2324-12-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2324-4-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2324-3-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2324-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2324-14-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download