253c4b8596352a6e5e392b199baec47ed3cef2637b3a9a720386c34ccdb48f82

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:33

Target

070b0a651c8e334ae54521c306bdb282.exe
Size

209KB
MD5

070b0a651c8e334ae54521c306bdb282
SHA1

94d681801ad7cb5fcd9fae40821d2aa39c385de8
SHA256

253c4b8596352a6e5e392b199baec47ed3cef2637b3a9a720386c34ccdb48f82
SHA512

5508cea1ac3fbb7fe7fd7fb3542b4b24c37d603088f1d28e2b2a3170e15e0d9c4e4a49ab2ede45949e5baad5a9801a095d07511c32f5531f253d9491ea6305a7
SSDEEP

6144:lldG8Jn86fjVdcWnTTt4//mIu5Tiq8zVBlVcX:NGE86fkWTTt43Dzfl

Score

7^/10

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2052	1216	070b0a651c8e334ae54521c306bdb282.exe	17
PID 1216 wrote to memory of 2052	1216	070b0a651c8e334ae54521c306bdb282.exe	17
PID 1216 wrote to memory of 2052	1216	070b0a651c8e334ae54521c306bdb282.exe	17
PID 1216 wrote to memory of 2052	1216	070b0a651c8e334ae54521c306bdb282.exe	17
PID 2052 wrote to memory of 2096	2052	cmd.exe	16
PID 2052 wrote to memory of 2096	2052	cmd.exe	16
PID 2052 wrote to memory of 2096	2052	cmd.exe	16
PID 2052 wrote to memory of 2096	2052	cmd.exe	16
PID 2052 wrote to memory of 2456	2052	cmd.exe	33
PID 2052 wrote to memory of 2456	2052	cmd.exe	33
PID 2052 wrote to memory of 2456	2052	cmd.exe	33
PID 2052 wrote to memory of 2456	2052	cmd.exe	33
PID 2456 wrote to memory of 2784	2456	u.dll	32
PID 2456 wrote to memory of 2784	2456	u.dll	32
PID 2456 wrote to memory of 2784	2456	u.dll	32
PID 2456 wrote to memory of 2784	2456	u.dll	32
PID 2052 wrote to memory of 1992	2052	cmd.exe	31
PID 2052 wrote to memory of 1992	2052	cmd.exe	31
PID 2052 wrote to memory of 1992	2052	cmd.exe	31
PID 2052 wrote to memory of 1992	2052	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\070b0a651c8e334ae54521c306bdb282.exe
"C:\Users\Admin\AppData\Local\Temp\070b0a651c8e334ae54521c306bdb282.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\F1E.tmp\vir.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\calc.exe
    CALC.EXE
    3⤵
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2456

C:\Users\Admin\AppData\Local\Temp\u.dll
u.dll -bat vir.bat -save 070b0a651c8e334ae54521c306bdb282.exe.com -include s.dll -overwrite -nodelete
1⤵
- Executes dropped EXE
PID:2096

C:\Users\Admin\AppData\Local\Temp\2B06.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\2B06.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe2B07.tmp"
1⤵
- Executes dropped EXE
PID:2784

memory/1216-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1216-109-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2456-94-0x0000000000370000-0x00000000003A4000-memory.dmp

Filesize
208KB

Download
memory/2456-92-0x0000000000370000-0x00000000003A4000-memory.dmp

Filesize
208KB

Download
memory/2784-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2784-100-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download