dd7c2ec5a657d609110efb6d00af2febcfc528b7c733493cfa90a8ac8760c9a8

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 06:21

Target

66eb36eb522d0d75a375f25137fedcd3.exe
Size

319KB
MD5

66eb36eb522d0d75a375f25137fedcd3
SHA1

c9a88a612cdd40527d86bf396d68d406c0c1593a
SHA256

dd7c2ec5a657d609110efb6d00af2febcfc528b7c733493cfa90a8ac8760c9a8
SHA512

dbdc499b8d3b4d1046a33fb89b8b73f1998dd3b20b07f16b6fb0159b837d410d1914b2b116c07516fbe4ff794230b7c440015384c8802a69bee9c5fbc09fd40a
SSDEEP

1536:ZQvBHZgFLJzSLWTVNyO5BMD8DXiDSkvHF5OauCCVmgleSe+eooOoaoCoCo0oBoF1:8hZgFLGSNyO5Bnso

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2336	Del73D9.tmp

Executes dropped EXE 1 IoCs

pid	Process
2336	Del73D9.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\zxcv.vbs	66eb36eb522d0d75a375f25137fedcd3.exe
File opened for modification	C:\WINDOWS\zxcv.vbs	Del73D9.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1968	1972	66eb36eb522d0d75a375f25137fedcd3.exe	16
PID 1972 wrote to memory of 1968	1972	66eb36eb522d0d75a375f25137fedcd3.exe	16
PID 1972 wrote to memory of 1968	1972	66eb36eb522d0d75a375f25137fedcd3.exe	16
PID 1972 wrote to memory of 1968	1972	66eb36eb522d0d75a375f25137fedcd3.exe	16
PID 1972 wrote to memory of 2336	1972	66eb36eb522d0d75a375f25137fedcd3.exe	29
PID 1972 wrote to memory of 2336	1972	66eb36eb522d0d75a375f25137fedcd3.exe	29
PID 1972 wrote to memory of 2336	1972	66eb36eb522d0d75a375f25137fedcd3.exe	29
PID 1972 wrote to memory of 2336	1972	66eb36eb522d0d75a375f25137fedcd3.exe	29
PID 2336 wrote to memory of 2376	2336	Del73D9.tmp	30
PID 2336 wrote to memory of 2376	2336	Del73D9.tmp	30
PID 2336 wrote to memory of 2376	2336	Del73D9.tmp	30
PID 2336 wrote to memory of 2376	2336	Del73D9.tmp	30

C:\Users\Admin\AppData\Local\Temp\Del73D9.tmp

Filesize
319KB

MD5
66eb36eb522d0d75a375f25137fedcd3

SHA1
c9a88a612cdd40527d86bf396d68d406c0c1593a

SHA256
dd7c2ec5a657d609110efb6d00af2febcfc528b7c733493cfa90a8ac8760c9a8

SHA512
dbdc499b8d3b4d1046a33fb89b8b73f1998dd3b20b07f16b6fb0159b837d410d1914b2b116c07516fbe4ff794230b7c440015384c8802a69bee9c5fbc09fd40a

Download Submit
C:\WINDOWS\zxcv.vbs

Filesize
262KB

MD5
6eb497ff0c637387f3afc721c6e08f2c

SHA1
308a5b00a1012ca932b544362018427e318e940d

SHA256
bcbbdcaae49d005d07d98ff11702391427a7d7848fd0843a256216d9dce57def

SHA512
844b07d97a73ffc246a2fb74f9d7cca9e61b669f79c78c12e1751e09efdabb69071e2bbd99caae1035b6ad588d4478f73dd204bfe9b209d4fdaf61ffd65066e8

Download Submit