bd61a0f889eee98bb045244f838965ba058c72d9882af9767734f262f042b0c2

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:59

Target

75080b53976515b2848f00b996d34398.exe
Size

169KB
MD5

75080b53976515b2848f00b996d34398
SHA1

ee0a6934612dd2a6710c6f5f3140092cc8ffbb8d
SHA256

bd61a0f889eee98bb045244f838965ba058c72d9882af9767734f262f042b0c2
SHA512

51ccd8e9e6722b79aa9700b620ad50e72219320010700be87b76b1136ed0099f2f71a03c77e58b41dd9b77b52af9535ac87d004368b7216e114b57a6100e89cd
SSDEEP

3072:fk1G5P2SP6mDjPBiK8zy1J1Y+F2M46X6t1e75bCyZ94hi1ffHef0ZgUKRE2Nrrdx:aiPRPlDjJB8z+F2gX975jUEeseUTUXdx

Score

7^/10

Deletes itself 1 IoCs

Processes:

75080b53976515b2848f00b996d34398.exe

pid process

2380 75080b53976515b2848f00b996d34398.exe
Executes dropped EXE 1 IoCs

Processes:

75080b53976515b2848f00b996d34398.exe

pid process

2380 75080b53976515b2848f00b996d34398.exe
Loads dropped DLL 1 IoCs

Processes:

75080b53976515b2848f00b996d34398.exe

pid process

3000 75080b53976515b2848f00b996d34398.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

75080b53976515b2848f00b996d34398.exe

pid process

3000 75080b53976515b2848f00b996d34398.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

75080b53976515b2848f00b996d34398.exe75080b53976515b2848f00b996d34398.exe

pid process

3000 75080b53976515b2848f00b996d34398.exe
2380 75080b53976515b2848f00b996d34398.exe

pid	process
2380	75080b53976515b2848f00b996d34398.exe

pid	process
2380	75080b53976515b2848f00b996d34398.exe

pid	process
3000	75080b53976515b2848f00b996d34398.exe

pid	process
3000	75080b53976515b2848f00b996d34398.exe

pid	process
3000	75080b53976515b2848f00b996d34398.exe
2380	75080b53976515b2848f00b996d34398.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

75080b53976515b2848f00b996d34398.exe

description	pid	process	target process
PID 3000 wrote to memory of 2380	3000	75080b53976515b2848f00b996d34398.exe	75080b53976515b2848f00b996d34398.exe
PID 3000 wrote to memory of 2380	3000	75080b53976515b2848f00b996d34398.exe	75080b53976515b2848f00b996d34398.exe
PID 3000 wrote to memory of 2380	3000	75080b53976515b2848f00b996d34398.exe	75080b53976515b2848f00b996d34398.exe
PID 3000 wrote to memory of 2380	3000	75080b53976515b2848f00b996d34398.exe	75080b53976515b2848f00b996d34398.exe

\Users\Admin\AppData\Local\Temp\75080b53976515b2848f00b996d34398.exe
Filesize
169KB

MD5
cf808cf0eb57276093551ac4d2ea7e6b

SHA1
99b38f55f7dece4152fba539771184ba74ba9b20

SHA256
f905819c230585322f444fce709d7532724b5d4a237602fc0945a5e2175bcc7c

SHA512
83326040a9b7a19f3987fde687f169122e98d96258a40fb5069feb9db37f95af654839aa579c73d035ff4767e6f9453deabfea1d434cec2168ae02efb80d3ada

Download Submit
memory/2380-17-0x00000000002C0000-0x00000000002EF000-memory.dmp

Filesize
188KB

Download
memory/2380-23-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2380-28-0x0000000000320000-0x000000000033B000-memory.dmp

Filesize
108KB

Download
memory/3000-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3000-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3000-1-0x0000000000140000-0x000000000016F000-memory.dmp

Filesize
188KB

Download
memory/3000-12-0x0000000002BE0000-0x0000000002C0F000-memory.dmp

Filesize
188KB

Download
memory/3000-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download