e5e8b1217cac444e0f89a69c678a0687a25a4dbdcc63a102b4e675944b97d469

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 00:03 UTC

Target

51fd50df40d19d13b412383197889471.exe
Size

209KB
MD5

51fd50df40d19d13b412383197889471
SHA1

67a8984b803f9543de5307d04381bf378675b138
SHA256

e5e8b1217cac444e0f89a69c678a0687a25a4dbdcc63a102b4e675944b97d469
SHA512

14248e5cc0d24aa33bb679a39300c64c35c08f1a22a763a8f96ee063af152c74220e24237b0a57c2a20b9ad76df01e88fb636a7cc9f0dd7288aff69006c78ab8
SSDEEP

3072:FldnAR6Ox0hqHb04xgQW2XGjrfWkv7gVyEW8947OhYCHGXODvjLiOoRda1E/ejuK:FlddzozE2XGjrWD7bubC6273E/kEl

Score

7^/10

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2660	1936	51fd50df40d19d13b412383197889471.exe	17
PID 1936 wrote to memory of 2660	1936	51fd50df40d19d13b412383197889471.exe	17
PID 1936 wrote to memory of 2660	1936	51fd50df40d19d13b412383197889471.exe	17
PID 1936 wrote to memory of 2660	1936	51fd50df40d19d13b412383197889471.exe	17
PID 2660 wrote to memory of 2744	2660	cmd.exe	16
PID 2660 wrote to memory of 2744	2660	cmd.exe	16
PID 2660 wrote to memory of 2744	2660	cmd.exe	16
PID 2660 wrote to memory of 2744	2660	cmd.exe	16
PID 2744 wrote to memory of 2604	2744	u.dll	15
PID 2744 wrote to memory of 2604	2744	u.dll	15
PID 2744 wrote to memory of 2604	2744	u.dll	15
PID 2744 wrote to memory of 2604	2744	u.dll	15
PID 2660 wrote to memory of 2180	2660	cmd.exe	14
PID 2660 wrote to memory of 2180	2660	cmd.exe	14
PID 2660 wrote to memory of 2180	2660	cmd.exe	14
PID 2660 wrote to memory of 2180	2660	cmd.exe	14
PID 2660 wrote to memory of 2832	2660	cmd.exe	33
PID 2660 wrote to memory of 2832	2660	cmd.exe	33
PID 2660 wrote to memory of 2832	2660	cmd.exe	33
PID 2660 wrote to memory of 2832	2660	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\u.dll
u.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete
1⤵
- Executes dropped EXE
PID:2180

C:\Users\Admin\AppData\Local\Temp\19C8.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\19C8.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe19C9.tmp"
1⤵
- Executes dropped EXE
PID:2604

C:\Users\Admin\AppData\Local\Temp\51fd50df40d19d13b412383197889471.exe
"C:\Users\Admin\AppData\Local\Temp\51fd50df40d19d13b412383197889471.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

memory/1936-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1936-107-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2604-69-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2604-74-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2744-68-0x0000000000650000-0x0000000000684000-memory.dmp

Filesize
208KB

Download
memory/2744-66-0x0000000000650000-0x0000000000684000-memory.dmp

Filesize
208KB

Download