b4328c9a512a95228a73f3c58ed2eafb7c7568270ca8997ebc752279eb4193cc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:24

Target

14671ebddac3211b50ad33cdce957ad2.exe
Size

12KB
MD5

14671ebddac3211b50ad33cdce957ad2
SHA1

82b417d7cc3556b36adc4a2bc6c643135074930f
SHA256

b4328c9a512a95228a73f3c58ed2eafb7c7568270ca8997ebc752279eb4193cc
SHA512

9ada9abea15f3ebca120f70ff813b234aaded3c9da295a4de030df1c1e239d1a942b70b75d04f76ee2e0232294490b7a4e9e1f758974dd00988ccd5a219d2fca
SSDEEP

384:IstSSDQRhH8LZ+Soq7Trl3KgpR9NmVmk9EDY:xSSDkSoq7nFfWV7EDY

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2828	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2180	A.PIF

Loads dropped DLL 2 IoCs

pid	Process
2084	14671ebddac3211b50ad33cdce957ad2.exe
2084	14671ebddac3211b50ad33cdce957ad2.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2084	14671ebddac3211b50ad33cdce957ad2.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
484	Process not Found

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2180	2084	14671ebddac3211b50ad33cdce957ad2.exe	28
PID 2084 wrote to memory of 2180	2084	14671ebddac3211b50ad33cdce957ad2.exe	28
PID 2084 wrote to memory of 2180	2084	14671ebddac3211b50ad33cdce957ad2.exe	28
PID 2084 wrote to memory of 2180	2084	14671ebddac3211b50ad33cdce957ad2.exe	28
PID 2084 wrote to memory of 2828	2084	14671ebddac3211b50ad33cdce957ad2.exe	29
PID 2084 wrote to memory of 2828	2084	14671ebddac3211b50ad33cdce957ad2.exe	29
PID 2084 wrote to memory of 2828	2084	14671ebddac3211b50ad33cdce957ad2.exe	29
PID 2084 wrote to memory of 2828	2084	14671ebddac3211b50ad33cdce957ad2.exe	29

C:\Users\Admin\AppData\Local\Temp\14671ebddac3211b50ad33cdce957ad2.exe
"C:\Users\Admin\AppData\Local\Temp\14671ebddac3211b50ad33cdce957ad2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\A.PIF
  A.PIF
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\14671ebddac3211b50ad33cdce957ad2.exe"
  2⤵
  - Deletes itself
  PID:2828

C:\Users\Admin\AppData\Local\Temp\A.PIF

Filesize
6KB

MD5
9f405be26aea92be5750c05fe28cb133

SHA1
e5c5c5c192475cfdababa9740dee09bb59614d32

SHA256
cf13d6b72687004f2bdbbdd3e7c812ed359552e7c93763938f9177e3999d00dd

SHA512
ba966105255058a06d65f9d9a3379816beb07cc9919d958926f5214a537eab8266de71ea099606304eab4aa4c74c26136532fd47099bcf22eece3f2472449405

Download Submit