d0051eec84e965bcc80b3d5cbcabfff3a92ad475d6a7b45d8fd2fd37cbe6bed5

Analysis

max time kernel
7s
max time network
53s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 14:37

Target

VirusSign.2024.02.08/03eec9b444ff21a20e84fa8592478c22.exe
Size

405KB
MD5

03eec9b444ff21a20e84fa8592478c22
SHA1

9b1b7ff45b73f8cb9ad8f3037c3deeb6ed2e81a5
SHA256

705985fea4cbd638e8633fe77894a557420467020b2f71e35408b120df584a22
SHA512

826233a9f010e523f14273f78f33c89f8f95e610c406ed4ca017eba2b64668b18eb98f4fbe9ecb2a423607effd5d2e4ed486acb21e9e7e5839b0480f6696f60a
SSDEEP

6144:sy+T9tAllM7QuLYfGTLyN6Xu0g3nSnvCGbYCFafAoIhHO:sy+T9ellutLYfG3yNYlg3SvRbr2AoIh

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2760	Custom.exe

Loads dropped DLL 2 IoCs

pid	Process
2688	03eec9b444ff21a20e84fa8592478c22.exe
2688	03eec9b444ff21a20e84fa8592478c22.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Standard\Custom.exe	03eec9b444ff21a20e84fa8592478c22.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2760	2688	03eec9b444ff21a20e84fa8592478c22.exe	29
PID 2688 wrote to memory of 2760	2688	03eec9b444ff21a20e84fa8592478c22.exe	29
PID 2688 wrote to memory of 2760	2688	03eec9b444ff21a20e84fa8592478c22.exe	29
PID 2688 wrote to memory of 2760	2688	03eec9b444ff21a20e84fa8592478c22.exe	29

\Program Files\Standard\Custom.exe

Filesize
405KB

MD5
d5fe977b055fe50172dc87fc08794bdc

SHA1
5a62a0dd4b30bf721f9b13a8fb156261d7fbc8b0

SHA256
0391ee32cb5daecec3252a8957f961ec29d4932aeef19ad33d876acb2a5bbe78

SHA512
7404497d1dd6eea00fd5cf4f1f9ed2b9b5fdbe3261de831f45f74185a191fcb115aadcb8f95ab8e0fba367784902c6f8a4ae7d6d7beb58803eb9c9b246c80ecc

Download Submit