14e45f66bb1010cd2bac463af2d39e7d49b3e08437f5e3db4a70c26d70c44c2b

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:53

Target

0cf39bdbd7a96e4e38d55a9853169964.exe
Size

677KB
MD5

0cf39bdbd7a96e4e38d55a9853169964
SHA1

15341f7a4d7dc5ffee9ab4be09e585fdf45299a6
SHA256

14e45f66bb1010cd2bac463af2d39e7d49b3e08437f5e3db4a70c26d70c44c2b
SHA512

f840430c7c0342dab15677f6924e1561257fd6091767bf0f7634f6b232ade09907d5c56a3ea943360abb423c5fdcb13089fda6db60d4a77e7261066201453c41
SSDEEP

12288:oigpqBNTX/C84ZrRj045nurrv6Q6BrYYMbhteQDZhOg5B/KEHiZofAAUmAY:oigwBNTvt4jjT5ng2QWYnbhteQDZhOgD

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2708	0cf39bdbd7a96e4e38d55a9853169964.tmp

Loads dropped DLL 1 IoCs

pid	Process
2672	0cf39bdbd7a96e4e38d55a9853169964.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2708	2672	0cf39bdbd7a96e4e38d55a9853169964.exe	27
PID 2672 wrote to memory of 2708	2672	0cf39bdbd7a96e4e38d55a9853169964.exe	27
PID 2672 wrote to memory of 2708	2672	0cf39bdbd7a96e4e38d55a9853169964.exe	27
PID 2672 wrote to memory of 2708	2672	0cf39bdbd7a96e4e38d55a9853169964.exe	27
PID 2672 wrote to memory of 2708	2672	0cf39bdbd7a96e4e38d55a9853169964.exe	27
PID 2672 wrote to memory of 2708	2672	0cf39bdbd7a96e4e38d55a9853169964.exe	27
PID 2672 wrote to memory of 2708	2672	0cf39bdbd7a96e4e38d55a9853169964.exe	27

C:\Users\Admin\AppData\Local\Temp\0cf39bdbd7a96e4e38d55a9853169964.exe
"C:\Users\Admin\AppData\Local\Temp\0cf39bdbd7a96e4e38d55a9853169964.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\is-M7K3C.tmp\0cf39bdbd7a96e4e38d55a9853169964.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-M7K3C.tmp\0cf39bdbd7a96e4e38d55a9853169964.tmp" /SL5="$4016A,645914,54272,C:\Users\Admin\AppData\Local\Temp\0cf39bdbd7a96e4e38d55a9853169964.exe"
  2⤵
  - Executes dropped EXE
  PID:2708

memory/2672-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2672-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2708-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download