23ff496319a696c1686450dc75276fbed2f80001c25be4a49b28cb0250f9c52f

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 11:26 UTC

Target

506de9e518439c0120583e8598df0298.exe
Size

208KB
MD5

506de9e518439c0120583e8598df0298
SHA1

36206bc6ddde1a8931c8f8bab228ce9051b8ef90
SHA256

23ff496319a696c1686450dc75276fbed2f80001c25be4a49b28cb0250f9c52f
SHA512

34bf06e87c9806c8a80392439af00eb9090bfe1cd3024fb3b365f25bab3ec3bf362c653d68fc81315ded3e49ab3de0902f1b04cf8b0fb1550a8f53fa46866218
SSDEEP

6144:Cl2/rra+K+Unhhpir6snbxoCXkhVVE3WSVW:7o+UnDpir62ddXOj2e

Score

7^/10

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2376	2384	506de9e518439c0120583e8598df0298.exe	17
PID 2384 wrote to memory of 2376	2384	506de9e518439c0120583e8598df0298.exe	17
PID 2384 wrote to memory of 2376	2384	506de9e518439c0120583e8598df0298.exe	17
PID 2384 wrote to memory of 2376	2384	506de9e518439c0120583e8598df0298.exe	17
PID 2376 wrote to memory of 1320	2376	cmd.exe	16
PID 2376 wrote to memory of 1320	2376	cmd.exe	16
PID 2376 wrote to memory of 1320	2376	cmd.exe	16
PID 2376 wrote to memory of 1320	2376	cmd.exe	16
PID 2376 wrote to memory of 2612	2376	cmd.exe	33
PID 2376 wrote to memory of 2612	2376	cmd.exe	33
PID 2376 wrote to memory of 2612	2376	cmd.exe	33
PID 2376 wrote to memory of 2612	2376	cmd.exe	33
PID 2612 wrote to memory of 2532	2612	u.dll	32
PID 2612 wrote to memory of 2532	2612	u.dll	32
PID 2612 wrote to memory of 2532	2612	u.dll	32
PID 2612 wrote to memory of 2532	2612	u.dll	32
PID 2376 wrote to memory of 2812	2376	cmd.exe	31
PID 2376 wrote to memory of 2812	2376	cmd.exe	31
PID 2376 wrote to memory of 2812	2376	cmd.exe	31
PID 2376 wrote to memory of 2812	2376	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\506de9e518439c0120583e8598df0298.exe
"C:\Users\Admin\AppData\Local\Temp\506de9e518439c0120583e8598df0298.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FC9.tmp\vir.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\calc.exe
    CALC.EXE
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2612

C:\Users\Admin\AppData\Local\Temp\u.dll
u.dll -bat vir.bat -save 506de9e518439c0120583e8598df0298.exe.com -include s.dll -overwrite -nodelete
1⤵
- Executes dropped EXE
PID:1320

C:\Users\Admin\AppData\Local\Temp\2BC2.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe2BC3.tmp"
1⤵
- Executes dropped EXE
PID:2532

memory/2384-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2384-108-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2532-93-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2532-99-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2612-92-0x00000000004C0000-0x00000000004F4000-memory.dmp

Filesize
208KB

Download