eb3a9b0edefc43c50f2ce71ab1cde8aa0c5c5db4f666465e5a5ffa4817d5a2da

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:54

Target

f77fcec97123195992b7f9460fcff625.exe
Size

60KB
MD5

f77fcec97123195992b7f9460fcff625
SHA1

639b081e73d197e9963a43a3f3e9a302c5ee7dd9
SHA256

eb3a9b0edefc43c50f2ce71ab1cde8aa0c5c5db4f666465e5a5ffa4817d5a2da
SHA512

5c7f965fc12f296334d8e0be563e175524257f0ee51ccd069fb2bfbb31464dc298bd9bc24e02dc09434532e2b765f62a7243fd3868d6982883f1374f8d0a05d6
SSDEEP

768:vCru/f9Iw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOOo:71Tzy48untU8fOMEI3jyYfPiuOo

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2016	2348	f77fcec97123195992b7f9460fcff625.exe	19
PID 2348 wrote to memory of 2016	2348	f77fcec97123195992b7f9460fcff625.exe	19
PID 2348 wrote to memory of 2016	2348	f77fcec97123195992b7f9460fcff625.exe	19
PID 2348 wrote to memory of 2016	2348	f77fcec97123195992b7f9460fcff625.exe	19
PID 2016 wrote to memory of 2844	2016	cmd.exe	16
PID 2016 wrote to memory of 2844	2016	cmd.exe	16
PID 2016 wrote to memory of 2844	2016	cmd.exe	16
PID 2016 wrote to memory of 2844	2016	cmd.exe	16
PID 2844 wrote to memory of 2900	2844	iexpress.exe	17
PID 2844 wrote to memory of 2900	2844	iexpress.exe	17
PID 2844 wrote to memory of 2900	2844	iexpress.exe	17
PID 2844 wrote to memory of 2900	2844	iexpress.exe	17

C:\Users\Admin\AppData\Local\Temp\f77fcec97123195992b7f9460fcff625.exe
"C:\Users\Admin\AppData\Local\Temp\f77fcec97123195992b7f9460fcff625.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\4B72.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\f77fcec97123195992b7f9460fcff625.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016

C:\Windows\SysWOW64\iexpress.exe
iexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\makecab.exe
  C:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"
  2⤵
  PID:2900