8392e8ebc86eb5bebab49ea05619f7f52f350224d7d308e34be7d818aa85981c

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:08

Target

130401c7bd47fd5772fe61ee7e37199a.exe
Size

209KB
MD5

130401c7bd47fd5772fe61ee7e37199a
SHA1

d3d4c6f8c16403ea0cafd0857ca51579a5d764f1
SHA256

8392e8ebc86eb5bebab49ea05619f7f52f350224d7d308e34be7d818aa85981c
SHA512

07b6c451f1ebe41671ba3369bf4622cab20de6591c547fd59862a6f557f60fc12f5a6f2051713ce92439c5b23ccdea0ce293af1dfcd43e063329c1c6ff53e77b
SSDEEP

6144:VltGmukwuqEBv9KgZI4Szs66U4e8lVkw2AnhW1Hg:NGmN1Z9uzsKF8f6n1

Score

7^/10

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2000	624	130401c7bd47fd5772fe61ee7e37199a.exe	17
PID 624 wrote to memory of 2000	624	130401c7bd47fd5772fe61ee7e37199a.exe	17
PID 624 wrote to memory of 2000	624	130401c7bd47fd5772fe61ee7e37199a.exe	17
PID 624 wrote to memory of 2000	624	130401c7bd47fd5772fe61ee7e37199a.exe	17
PID 2000 wrote to memory of 1788	2000	cmd.exe	16
PID 2000 wrote to memory of 1788	2000	cmd.exe	16
PID 2000 wrote to memory of 1788	2000	cmd.exe	16
PID 2000 wrote to memory of 1788	2000	cmd.exe	16
PID 2000 wrote to memory of 2832	2000	cmd.exe	33
PID 2000 wrote to memory of 2832	2000	cmd.exe	33
PID 2000 wrote to memory of 2832	2000	cmd.exe	33
PID 2000 wrote to memory of 2832	2000	cmd.exe	33
PID 2832 wrote to memory of 2572	2832	u.dll	32
PID 2832 wrote to memory of 2572	2832	u.dll	32
PID 2832 wrote to memory of 2572	2832	u.dll	32
PID 2832 wrote to memory of 2572	2832	u.dll	32
PID 2000 wrote to memory of 2440	2000	cmd.exe	31
PID 2000 wrote to memory of 2440	2000	cmd.exe	31
PID 2000 wrote to memory of 2440	2000	cmd.exe	31
PID 2000 wrote to memory of 2440	2000	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\130401c7bd47fd5772fe61ee7e37199a.exe
"C:\Users\Admin\AppData\Local\Temp\130401c7bd47fd5772fe61ee7e37199a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\1008.tmp\vir.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\calc.exe
    CALC.EXE
    3⤵
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2832

C:\Users\Admin\AppData\Local\Temp\u.dll
u.dll -bat vir.bat -save 130401c7bd47fd5772fe61ee7e37199a.exe.com -include s.dll -overwrite -nodelete
1⤵
- Executes dropped EXE
PID:1788

C:\Users\Admin\AppData\Local\Temp\2BF0.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe2BF1.tmp"
1⤵
- Executes dropped EXE
PID:2572

C:\Users\Admin\AppData\Local\Temp\1008.tmp\vir.bat

Filesize
1KB

MD5
f4720d714f192b79325554ae2bd89910

SHA1
bf53cdb9960e0a9ff3ee202b87853c7534423eb0

SHA256
90a2c39393b94e6490207859fe3be74fe0c2e530afcc11531ff777ed2c0d08e7

SHA512
c6739943b9280b5040dfae3703cdf21fef1ca583b8525d68337647b4ae579fa1df7fa38357af0c7c5eee0f4b375287e1378b304efe72bf79a25a89fc5b245ddb

Download Submit
\Users\Admin\AppData\Local\Temp\u.dll

Filesize
92KB

MD5
3ead3d1666a7ba5496ca7f0bdba490e6

SHA1
1c2707e1ed0b80eceb9e222e7c12e922e1ad1a13

SHA256
9c86a7b9cbd93a18253b5101b8a4272f9396e752177b5a49520384df06f18f5d

SHA512
147d684c5f73aa2aadc05c01c9aa31e887242edf53b97f151024ddf84384b2517dc6bd9a7bb52d9c607f47583b7b4868e809ad042e7f8e951e6a331004c62335

Download Submit
memory/624-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/624-109-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2572-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2572-100-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-94-0x00000000004C0000-0x00000000004F4000-memory.dmp

Filesize
208KB

Download
memory/2832-92-0x00000000004C0000-0x00000000004F4000-memory.dmp

Filesize
208KB

Download