8392e8ebc86eb5bebab49ea05619f7f52f350224d7d308e34be7d818aa85981c

Analysis

max time kernel
1s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 08:08

Target

130401c7bd47fd5772fe61ee7e37199a.exe
Size

209KB
MD5

130401c7bd47fd5772fe61ee7e37199a
SHA1

d3d4c6f8c16403ea0cafd0857ca51579a5d764f1
SHA256

8392e8ebc86eb5bebab49ea05619f7f52f350224d7d308e34be7d818aa85981c
SHA512

07b6c451f1ebe41671ba3369bf4622cab20de6591c547fd59862a6f557f60fc12f5a6f2051713ce92439c5b23ccdea0ce293af1dfcd43e063329c1c6ff53e77b
SSDEEP

6144:VltGmukwuqEBv9KgZI4Szs66U4e8lVkw2AnhW1Hg:NGmN1Z9uzsKF8f6n1

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
4680	u.dll
456	mpress.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2600	2764	130401c7bd47fd5772fe61ee7e37199a.exe	24
PID 2764 wrote to memory of 2600	2764	130401c7bd47fd5772fe61ee7e37199a.exe	24
PID 2764 wrote to memory of 2600	2764	130401c7bd47fd5772fe61ee7e37199a.exe	24
PID 2600 wrote to memory of 4680	2600	cmd.exe	17
PID 2600 wrote to memory of 4680	2600	cmd.exe	17
PID 2600 wrote to memory of 4680	2600	cmd.exe	17
PID 4680 wrote to memory of 456	4680	u.dll	23
PID 4680 wrote to memory of 456	4680	u.dll	23
PID 4680 wrote to memory of 456	4680	u.dll	23
PID 2600 wrote to memory of 2392	2600	cmd.exe	21
PID 2600 wrote to memory of 2392	2600	cmd.exe	21
PID 2600 wrote to memory of 2392	2600	cmd.exe	21

C:\Users\Admin\AppData\Local\Temp\130401c7bd47fd5772fe61ee7e37199a.exe
"C:\Users\Admin\AppData\Local\Temp\130401c7bd47fd5772fe61ee7e37199a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4640.tmp\vir.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600

C:\Users\Admin\AppData\Local\Temp\u.dll
u.dll -bat vir.bat -save 130401c7bd47fd5772fe61ee7e37199a.exe.com -include s.dll -overwrite -nodelete
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\46BD.tmp\mpress.exe
  "C:\Users\Admin\AppData\Local\Temp\46BD.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe46BE.tmp"
  2⤵
  - Executes dropped EXE
  PID:456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2896

memory/456-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/456-62-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2764-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2764-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2764-70-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download