3e52449ca7b4df018a6d8ff7404b10d81d31030dcebabe4f86b0e7504c905782

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 17:28

Target

6836c4e3ce82e8d65bf79b802613ea5b.exe
Size

86KB
MD5

6836c4e3ce82e8d65bf79b802613ea5b
SHA1

2425dfd751f1194b7c9d44bac6b33a82f6200854
SHA256

3e52449ca7b4df018a6d8ff7404b10d81d31030dcebabe4f86b0e7504c905782
SHA512

ab0797233317a15413f3b1c722ce1d0c58cb9203a123c04442fd9f589b14ca5420cf9629607c580e059693968f731180aa01cb9bfff7c5f78f980bfab4c9e8e0
SSDEEP

1536:A/bftSpkWBNHZpS5JoNAj/wpF2sS+LSBwglQgdrE8qpo9oWDEihHFLl11EzSzbWp:A/LFY5pyJoNo/GrSzwFgXqpo9N3LTeWs

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2664	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRTPROCS\x64\GRO1.tmp	6836c4e3ce82e8d65bf79b802613ea5b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2664	1308	6836c4e3ce82e8d65bf79b802613ea5b.exe	28
PID 1308 wrote to memory of 2664	1308	6836c4e3ce82e8d65bf79b802613ea5b.exe	28
PID 1308 wrote to memory of 2664	1308	6836c4e3ce82e8d65bf79b802613ea5b.exe	28
PID 1308 wrote to memory of 2664	1308	6836c4e3ce82e8d65bf79b802613ea5b.exe	28

C:\Users\Admin\AppData\Local\Temp\6836c4e3ce82e8d65bf79b802613ea5b.exe
"C:\Users\Admin\AppData\Local\Temp\6836c4e3ce82e8d65bf79b802613ea5b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "file.bat"
  2⤵
  - Deletes itself
  PID:2664

C:\Users\Admin\AppData\Local\Temp\file.bat

Filesize
179B

MD5
d3922d14e2fec71d958e35af679a9abf

SHA1
0649ed68c4f0a55096b3cb8ab0736d4fafbf4957

SHA256
4f563af0efc46db9b1d2a1dad7a391641a6cbd66cfd1093dd6f6de18bd36299a

SHA512
5331308a77599d71fa54938e3af125e689ef24ad3357eacf3863bdea37a80852e27bdfdfa0b9ae34cba7e9b93b745c6b6847d50770e5320187aafce911c1ca0d

Download Submit
memory/1308-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1308-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1308-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download