ea37eb2bef7e1b335efeeaffb58617b3d02821a248b2bfa16b5f3be6e4740e77

Analysis

max time kernel
144s
max time network
46s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:28

Target

1a05be0f3722509a76e1b7e3ae514c2d.exe
Size

209KB
MD5

1a05be0f3722509a76e1b7e3ae514c2d
SHA1

9e78d9f697657f5e886d7931246a3d139c5240b8
SHA256

ea37eb2bef7e1b335efeeaffb58617b3d02821a248b2bfa16b5f3be6e4740e77
SHA512

2af2fa7c0cf97d8db5f821f3ce9ab9f79745756add4de1e9d0f97aafcfab18f5aae307bd015e17a57730c98999733236bf4db161c83929d013e57052f2f42b97
SSDEEP

3072:jldkpImZmosiqHaW3QZ1iq2rKC+JZoGdkKvFUtPS2xhomCMQ9N:jldMZm3nHaWmN2uNV/atrxhomo9

Score

7^/10

Executes dropped EXE 4 IoCs

Loads dropped DLL 8 IoCs

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2728	2680	1a05be0f3722509a76e1b7e3ae514c2d.exe	18
PID 2680 wrote to memory of 2728	2680	1a05be0f3722509a76e1b7e3ae514c2d.exe	18
PID 2680 wrote to memory of 2728	2680	1a05be0f3722509a76e1b7e3ae514c2d.exe	18
PID 2680 wrote to memory of 2728	2680	1a05be0f3722509a76e1b7e3ae514c2d.exe	18
PID 2728 wrote to memory of 2840	2728	cmd.exe	24
PID 2728 wrote to memory of 2840	2728	cmd.exe	24
PID 2728 wrote to memory of 2840	2728	cmd.exe	24
PID 2728 wrote to memory of 2840	2728	cmd.exe	24
PID 2840 wrote to memory of 2276	2840	u.dll	23
PID 2840 wrote to memory of 2276	2840	u.dll	23
PID 2840 wrote to memory of 2276	2840	u.dll	23
PID 2840 wrote to memory of 2276	2840	u.dll	23
PID 2728 wrote to memory of 976	2728	cmd.exe	22
PID 2728 wrote to memory of 976	2728	cmd.exe	22
PID 2728 wrote to memory of 976	2728	cmd.exe	22
PID 2728 wrote to memory of 976	2728	cmd.exe	22
PID 976 wrote to memory of 1076	976	u.dll	21
PID 976 wrote to memory of 1076	976	u.dll	21
PID 976 wrote to memory of 1076	976	u.dll	21
PID 976 wrote to memory of 1076	976	u.dll	21
PID 2728 wrote to memory of 2936	2728	cmd.exe	20
PID 2728 wrote to memory of 2936	2728	cmd.exe	20
PID 2728 wrote to memory of 2936	2728	cmd.exe	20
PID 2728 wrote to memory of 2936	2728	cmd.exe	20

C:\Users\Admin\AppData\Local\Temp\1a05be0f3722509a76e1b7e3ae514c2d.exe
"C:\Users\Admin\AppData\Local\Temp\1a05be0f3722509a76e1b7e3ae514c2d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FFA3.tmp\vir.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\calc.exe
    CALC.EXE
    3⤵
    PID:2936
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save 1a05be0f3722509a76e1b7e3ae514c2d.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2840

C:\Users\Admin\AppData\Local\Temp\223.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\223.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe224.tmp"
1⤵
- Executes dropped EXE
PID:1076

C:\Users\Admin\AppData\Local\Temp\7E.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\7E.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe7F.tmp"
1⤵
- Executes dropped EXE
PID:2276

memory/1076-139-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1076-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2276-70-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2276-76-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2680-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2680-153-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2840-69-0x0000000000290000-0x00000000002C4000-memory.dmp

Filesize
208KB

Download
memory/2840-63-0x0000000000290000-0x00000000002C4000-memory.dmp

Filesize
208KB

Download