7b1cf1979579775f48e8d20974753453f75963b3094d3b95519d9362e943dbbb

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDWCH2.exe
Size

739KB
MD5

0d5cc91890c411599e994ab4d927350b
SHA1

b64c4752537fc05bd460918fe252ef64e72d2651
SHA256

b64cc3011b334fe3fdc47852da28f1d865a1f71dd819827a035b9b3adab1a163
SHA512

56418a6586f0cc7f985e944811744fdce2ddaea5e238d02b21435768a3738ba7cccc738190b677f0eb66916a24cdcd4b63701df8a35c7a44802ba053ccdf059b
SSDEEP

6144:d/QiQXC45m+ksmpk3U9j0IeP2soxvjFEOTb9WmZX/8shzdsY4CpHPhnq/FK:VQi34c6m6UR0IeP2p1hf39Wkv8xwJqdK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2752	IDWCH2.tmp

Loads dropped DLL 4 IoCs

pid	Process
1980	IDWCH2.exe
2752	IDWCH2.tmp
2752	IDWCH2.tmp
2752	IDWCH2.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2752	1980	IDWCH2.exe	20
PID 1980 wrote to memory of 2752	1980	IDWCH2.exe	20
PID 1980 wrote to memory of 2752	1980	IDWCH2.exe	20
PID 1980 wrote to memory of 2752	1980	IDWCH2.exe	20
PID 1980 wrote to memory of 2752	1980	IDWCH2.exe	20
PID 1980 wrote to memory of 2752	1980	IDWCH2.exe	20
PID 1980 wrote to memory of 2752	1980	IDWCH2.exe	20

C:\Users\Admin\AppData\Local\Temp\IDWCH2.exe
"C:\Users\Admin\AppData\Local\Temp\IDWCH2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\is-R0H9O.tmp\IDWCH2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-R0H9O.tmp\IDWCH2.tmp" /SL5="$40156,506127,422400,C:\Users\Admin\AppData\Local\Temp\IDWCH2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-R0H9O.tmp\IDWCH2.tmp

Filesize
91KB

MD5
c37df69adc78d02d2bb34189ba9f2318

SHA1
98eb5eacb57f5f1c45ba22999d02fc77c23c6a54

SHA256
d1b83114744016a9f8292c849da47993c14e84f09b817e3aac6043d4e47c7d64

SHA512
48df112ea69cf0926b9bb3305c47a7c42dc3c1ff4d989564c57f53cd311f91b3c6d49a166f1c4e6e0e9dfbbb411586c71b3a2234713a299e68e872400bb7b836

Download Submit
\Users\Admin\AppData\Local\Temp\is-CSB68.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-CSB68.tmp\idp.dll

Filesize
216KB

MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
\Users\Admin\AppData\Local\Temp\is-R0H9O.tmp\IDWCH2.tmp

Filesize
63KB

MD5
8cba8c51ce29d4c1df53c71b6c71ed82

SHA1
6766ac5e8b75f18c12579a9eb44081e30ab1d943

SHA256
9f936d06972917186ea45db84b952d3ff7ed31d80e2e7170b4514c430bf22fb2

SHA512
3d93ffcc7c90ec23d69ff49e3ff4f42dd0aae2c1b3337acf5e4746506e39d446a8fb4bf14e264615fa4bf52d68b7b64f9120af9ee9fa687641bac78524fc7ffd

Download Submit
memory/1980-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1980-23-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2752-7-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2752-21-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads