113b03ec5492e64922c627d6b68a5e810ff528af1253632c36030dc0dac405bf

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:57

Target

2c724219bc0e52083c2eda9a7eb64339.exe
Size

1001KB
MD5

2c724219bc0e52083c2eda9a7eb64339
SHA1

6fd5195b520e8fad05f79fb1d70079b9cb83b378
SHA256

113b03ec5492e64922c627d6b68a5e810ff528af1253632c36030dc0dac405bf
SHA512

e8476d1d4162ba7302a169e3e6be81455cfe9d9ee38dd9c4c0a6e2877ffa0f4890d5b9a2838f9f5668b40ebaff028d95ee5f075ac8b46fd779c1beddccea46fb
SSDEEP

24576:dgdhhQGGniba/WPpuvlBEaneHueYQFSMVbEfRq:dqj5s8+elYQFSMWq

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2392	d.exe

Loads dropped DLL 1 IoCs

pid	Process
2508	2c724219bc0e52083c2eda9a7eb64339.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\cu\d.exe	2c724219bc0e52083c2eda9a7eb64339.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2392	2508	2c724219bc0e52083c2eda9a7eb64339.exe	28
PID 2508 wrote to memory of 2392	2508	2c724219bc0e52083c2eda9a7eb64339.exe	28
PID 2508 wrote to memory of 2392	2508	2c724219bc0e52083c2eda9a7eb64339.exe	28
PID 2508 wrote to memory of 2392	2508	2c724219bc0e52083c2eda9a7eb64339.exe	28

C:\Users\Admin\AppData\Local\Temp\2c724219bc0e52083c2eda9a7eb64339.exe
"C:\Users\Admin\AppData\Local\Temp\2c724219bc0e52083c2eda9a7eb64339.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\cu\d.exe
  "C:\Program Files (x86)\cu\d.exe"
  2⤵
  - Executes dropped EXE
  PID:2392

C:\Program Files (x86)\cu\d.exe

Filesize
1019KB

MD5
8214e09eacdb6e5a06a30aef7c9cb034

SHA1
54949f9a656c8c8a992206581962f390999385f5

SHA256
7985fc4ad29102d30404f3eff3c3bca1259823cddcfe58e4b8d9739b155c78cc

SHA512
f2c87d43d9d5ba674f5854c2ace491dd69abbd5e3a8f4c10b8180bde3d51b296a8a93cd4ec0c436a4648d0d3b3ce9dfb1f52c4a3e48547fe6e6c63387ee15f83

Download Submit
memory/2392-6-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2508-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download