d9e87b1a36e9ba9323f3f06bfaad1e9a539afb2c1c830e664c2a9ae4673a12eb

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:51

Target

035a9ecb8fe641f09ad28cf3781b29a2.exe
Size

105KB
MD5

035a9ecb8fe641f09ad28cf3781b29a2
SHA1

d057243ccc4fe78387926d017601db4086e5741f
SHA256

d9e87b1a36e9ba9323f3f06bfaad1e9a539afb2c1c830e664c2a9ae4673a12eb
SHA512

e33a95012543a2340af608d63004a694ee9a88af3ee18398dfc28b3ab3fdf1bd4ebbcfe206f6a7e1d561e1058c95b02641d32c06b1dba0fa29b6fd0585503d4f
SSDEEP

1536:3CqlwmQeLWzCAt9kqqYsQEuWLvtW/hBYLpFHSBGrE/SrRVcc:bXqbsnuW4JBWp1SgoKfcc

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2220	winwm.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\winwm.dll	035a9ecb8fe641f09ad28cf3781b29a2.exe
File created	C:\Windows\winwm.exe	035a9ecb8fe641f09ad28cf3781b29a2.exe
File opened for modification	C:\Windows\winwm.exe	035a9ecb8fe641f09ad28cf3781b29a2.exe
File created	C:\Windows\winwm.dll	winwm.exe
File created	C:\Windows\winwm.exe	winwm.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2220	2360	035a9ecb8fe641f09ad28cf3781b29a2.exe	16
PID 2360 wrote to memory of 2220	2360	035a9ecb8fe641f09ad28cf3781b29a2.exe	16
PID 2360 wrote to memory of 2220	2360	035a9ecb8fe641f09ad28cf3781b29a2.exe	16
PID 2360 wrote to memory of 2220	2360	035a9ecb8fe641f09ad28cf3781b29a2.exe	16