83fe2ee4ea637ebf843eb699a5a2b1ebfc1037193c30152436e761da67a797e6

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 02:48

Target

47d24f9fc829b9cef788139b206f1d58.exe
Size

89KB
MD5

47d24f9fc829b9cef788139b206f1d58
SHA1

e8376ebe263d718b7f2e2162a4feb83fdb953a99
SHA256

83fe2ee4ea637ebf843eb699a5a2b1ebfc1037193c30152436e761da67a797e6
SHA512

5c447e0431d4dc6ea81ca54cb2a2995a31229f750a7399353ac8012618c7e854afdd7f9611d6daf89692c680e06f20ee572057567f4b3ef5b338d5f475eb4726
SSDEEP

1536:oldl/uvdD7hgXLqDQUVGu2ApbVqr8oorFPkmq:kMD7hgXJUVjG/sPr

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2288	ipsec.exe

Loads dropped DLL 2 IoCs

pid	Process
2096	47d24f9fc829b9cef788139b206f1d58.exe
2096	47d24f9fc829b9cef788139b206f1d58.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ipsec.exe	47d24f9fc829b9cef788139b206f1d58.exe
File opened for modification	C:\Windows\SysWOW64\ipsec.exe	47d24f9fc829b9cef788139b206f1d58.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2288	2096	47d24f9fc829b9cef788139b206f1d58.exe	28
PID 2096 wrote to memory of 2288	2096	47d24f9fc829b9cef788139b206f1d58.exe	28
PID 2096 wrote to memory of 2288	2096	47d24f9fc829b9cef788139b206f1d58.exe	28
PID 2096 wrote to memory of 2288	2096	47d24f9fc829b9cef788139b206f1d58.exe	28

C:\Users\Admin\AppData\Local\Temp\47d24f9fc829b9cef788139b206f1d58.exe
"C:\Users\Admin\AppData\Local\Temp\47d24f9fc829b9cef788139b206f1d58.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\ipsec.exe
  C:\Windows\system32\ipsec.exe 504 "C:\Users\Admin\AppData\Local\Temp\47d24f9fc829b9cef788139b206f1d58.exe"
  2⤵
  - Executes dropped EXE
  PID:2288

\Windows\SysWOW64\ipsec.exe

Filesize
89KB

MD5
47d24f9fc829b9cef788139b206f1d58

SHA1
e8376ebe263d718b7f2e2162a4feb83fdb953a99

SHA256
83fe2ee4ea637ebf843eb699a5a2b1ebfc1037193c30152436e761da67a797e6

SHA512
5c447e0431d4dc6ea81ca54cb2a2995a31229f750a7399353ac8012618c7e854afdd7f9611d6daf89692c680e06f20ee572057567f4b3ef5b338d5f475eb4726

Download Submit
memory/2096-0-0x000000001F840000-0x000000001F856000-memory.dmp

Filesize
88KB

Download
memory/2096-1-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download
memory/2096-6-0x00000000002E0000-0x00000000002F6000-memory.dmp

Filesize
88KB

Download
memory/2096-16-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download
memory/2288-14-0x0000000000570000-0x00000000006BD000-memory.dmp

Filesize
1.3MB

Download
memory/2288-13-0x000000001F840000-0x000000001F856000-memory.dmp

Filesize
88KB

Download