a869136ca1d7fe2df2d6e8b0dcce2e72d1879c9d02c09114eff3f50abc4ce430

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:29

Target

728cdc19d2719172c585821ae0f039f0.exe
Size

209KB
MD5

728cdc19d2719172c585821ae0f039f0
SHA1

5c033f9c3c0aecf4cdeb16b866f7449c3ca15841
SHA256

a869136ca1d7fe2df2d6e8b0dcce2e72d1879c9d02c09114eff3f50abc4ce430
SHA512

9af605752ddaac8b14b56d18dea1241aefcb7bd0b49692464212d073a6f229ded20781593aad75c9f3bc606cc23b186d1e6be9b5139e71d1cf10db0658b81314
SSDEEP

3072:glhg7vQsqRjP6wslpFZ/hWoasvzFjH9KLVAhXIrEnZDXOuVJJ11FgiCCmRG1fxRr:gl2zbMpsvzFjH8LOhfhBVJJxtCr01fq

Score

7^/10

Executes dropped EXE 4 IoCs

Loads dropped DLL 8 IoCs

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2884	2252	728cdc19d2719172c585821ae0f039f0.exe	19
PID 2252 wrote to memory of 2884	2252	728cdc19d2719172c585821ae0f039f0.exe	19
PID 2252 wrote to memory of 2884	2252	728cdc19d2719172c585821ae0f039f0.exe	19
PID 2252 wrote to memory of 2884	2252	728cdc19d2719172c585821ae0f039f0.exe	19
PID 2884 wrote to memory of 2160	2884	cmd.exe	18
PID 2884 wrote to memory of 2160	2884	cmd.exe	18
PID 2884 wrote to memory of 2160	2884	cmd.exe	18
PID 2884 wrote to memory of 2160	2884	cmd.exe	18
PID 2160 wrote to memory of 2752	2160	u.dll	17
PID 2160 wrote to memory of 2752	2160	u.dll	17
PID 2160 wrote to memory of 2752	2160	u.dll	17
PID 2160 wrote to memory of 2752	2160	u.dll	17
PID 2884 wrote to memory of 2332	2884	cmd.exe	16
PID 2884 wrote to memory of 2332	2884	cmd.exe	16
PID 2884 wrote to memory of 2332	2884	cmd.exe	16
PID 2884 wrote to memory of 2332	2884	cmd.exe	16
PID 2332 wrote to memory of 1700	2332	u.dll	15
PID 2332 wrote to memory of 1700	2332	u.dll	15
PID 2332 wrote to memory of 1700	2332	u.dll	15
PID 2332 wrote to memory of 1700	2332	u.dll	15
PID 2884 wrote to memory of 2228	2884	cmd.exe	14
PID 2884 wrote to memory of 2228	2884	cmd.exe	14
PID 2884 wrote to memory of 2228	2884	cmd.exe	14
PID 2884 wrote to memory of 2228	2884	cmd.exe	14

C:\Users\Admin\AppData\Local\Temp\1D31.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\1D31.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe1D32.tmp"
1⤵
- Executes dropped EXE
PID:1700

C:\Users\Admin\AppData\Local\Temp\1C66.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\1C66.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe1C67.tmp"
1⤵
- Executes dropped EXE
PID:2752

C:\Users\Admin\AppData\Local\Temp\728cdc19d2719172c585821ae0f039f0.exe
"C:\Users\Admin\AppData\Local\Temp\728cdc19d2719172c585821ae0f039f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252

memory/1700-139-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1700-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2160-71-0x00000000005C0000-0x00000000005F4000-memory.dmp

Filesize
208KB

Download
memory/2160-67-0x00000000005C0000-0x00000000005F4000-memory.dmp

Filesize
208KB

Download
memory/2252-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2252-153-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2752-69-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-76-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download