15b0da6ad8c88b0e5e070ba6cf8d300b76f3d73152a82f179126738e1135f0b2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:37

Target

07279d8c78073b04b3bec40599b64458.exe
Size

780KB
MD5

07279d8c78073b04b3bec40599b64458
SHA1

164875984581d8bb874d6e4d4fd8e4ba69dac4b0
SHA256

15b0da6ad8c88b0e5e070ba6cf8d300b76f3d73152a82f179126738e1135f0b2
SHA512

f2f5cf81027b53e422ac87cdedc558d53865030973b13208ccf50cd63c3d6a41acceecbfbc45591264c8663a094420bb66f3a2823ff3dd35dd710845765b8c4e
SSDEEP

24576:1gvgX0hvBmaXow1p5Klh3m5armax+BZjNLI:18qcN1pchbgbjm

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2984	07279d8c78073b04b3bec40599b64458.tmp

Loads dropped DLL 1 IoCs

pid	Process
2100	07279d8c78073b04b3bec40599b64458.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2984	2100	07279d8c78073b04b3bec40599b64458.exe	28
PID 2100 wrote to memory of 2984	2100	07279d8c78073b04b3bec40599b64458.exe	28
PID 2100 wrote to memory of 2984	2100	07279d8c78073b04b3bec40599b64458.exe	28
PID 2100 wrote to memory of 2984	2100	07279d8c78073b04b3bec40599b64458.exe	28

C:\Users\Admin\AppData\Local\Temp\07279d8c78073b04b3bec40599b64458.exe
"C:\Users\Admin\AppData\Local\Temp\07279d8c78073b04b3bec40599b64458.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\is-DBRD7.tmp\07279d8c78073b04b3bec40599b64458.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DBRD7.tmp\07279d8c78073b04b3bec40599b64458.tmp" /SL5="$400EC,761308,81408,C:\Users\Admin\AppData\Local\Temp\07279d8c78073b04b3bec40599b64458.exe"
  2⤵
  - Executes dropped EXE
  PID:2984

C:\Users\Admin\AppData\Local\Temp\is-DBRD7.tmp\07279d8c78073b04b3bec40599b64458.tmp

Filesize
12KB

MD5
9c058d308478ea44331467ce73bc756f

SHA1
2ace1bfd68870944686ed22251b8537453f74703

SHA256
805c05b94c8d5f3e7bfa2100847700ef0bd6f8c2129821303d79bb604cc9e74a

SHA512
a7caaffd8a40d0f439101434efafef252bfe612b0876756f5d82a7e47143c2f35ba333e1dd301a99cc628c4a39128665ef59555acb413a6377fb141b433b3d7a

Download Submit
\Users\Admin\AppData\Local\Temp\is-DBRD7.tmp\07279d8c78073b04b3bec40599b64458.tmp

Filesize
53KB

MD5
54451f3b3f85cf4db1ad0d7f75af8c34

SHA1
50dbfe6c8ecd5fd56edc58eaa14b79d96428e447

SHA256
f4875466aadd1fcf2341110614bc0bcf5d0355b30e3d73548a3b7eb85d4a2ced

SHA512
d8a9385d98bf2b2bddb53925786807b0795b6ffd8db0da4b674ba5088d19aa68d2f305450fdef2dc3b13675f7307180f330af2008a15dc306e3df8e4441c9628

Download Submit
memory/2100-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2100-13-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2984-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2984-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2984-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download