eaf3a238f26327d3db94e696f6705aa7d356dd50aca093aacb38d1bfb69f8647

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:31

Target

20182841cfdd24694fa029fb44768b0c.exe
Size

5KB
MD5

20182841cfdd24694fa029fb44768b0c
SHA1

4c6a1a933412edfdef072f3bfb05b1770ea04aad
SHA256

eaf3a238f26327d3db94e696f6705aa7d356dd50aca093aacb38d1bfb69f8647
SHA512

0e2ab26074a2488b6f09c27741a51b1b700e5fbcfea808178c793959a2052031a55a9fa57908b85ebb23be59b846bbb7fd019b1a6aef68ea70ba157fc56e5ddc
SSDEEP

96:cJ6h72Ms2fpQP04av9Bs6uA2SvQwm2zeeL6/qoZ76nwz+U:cJ6hixopQc/szA/teghnwzt

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2644	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2644	2320	20182841cfdd24694fa029fb44768b0c.exe	33
PID 2320 wrote to memory of 2644	2320	20182841cfdd24694fa029fb44768b0c.exe	33
PID 2320 wrote to memory of 2644	2320	20182841cfdd24694fa029fb44768b0c.exe	33
PID 2320 wrote to memory of 2644	2320	20182841cfdd24694fa029fb44768b0c.exe	33

C:\Users\Admin\AppData\Local\Temp\20182841cfdd24694fa029fb44768b0c.exe
"C:\Users\Admin\AppData\Local\Temp\20182841cfdd24694fa029fb44768b0c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo @echo off> "inst11.bat" & echo :try>>"inst11.bat" & echo @del /F /Q "C:\Users\Admin\AppData\Local\Temp\201828~1.EXE" >> "inst11.bat" & echo if exist "C:\Users\Admin\AppData\Local\Temp\201828~1.EXE" goto try>>inst11.bat & "inst11.bat" & @del /F /Q "inst11.bat"
  2⤵
  - Deletes itself
  PID:2644

C:\Users\Admin\AppData\Local\Temp\inst11.bat

Filesize
151B

MD5
bd6650ff587c3f5ab56f3e034a990ebe

SHA1
883de0760440fc980be4d11557fd8dc1f3b98da6

SHA256
b43a9216b95eae46bc5f4d3e54395642938b555e17221bd205e5dfb26875cdd5

SHA512
b82837de085c3650170d17172e6161eaf2199d4569dcce96902e8a4e08e257dcd8f633a29de9e7ebbb5ea118e6d081a53b52c5cdb374f1402d75b759f146c89a

Download Submit
memory/2320-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download