353d15184f93934d829210b52bb1392751527205481f7ba8178ca4ba7b7b95dd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-02-2024 11:11

Target

xcmd_beta.exe
Size

12.0MB
MD5

a7f6ac81005d3e507607fceec84172c2
SHA1

9a4cadbc83011d334dda40a68dabf18677715827
SHA256

353d15184f93934d829210b52bb1392751527205481f7ba8178ca4ba7b7b95dd
SHA512

953cd68bb37cf4131c2be2d81674dcf801f652a5ebb35b059df04123c906aecaf36da8724ea29b3e26cad60c16da211d9e8ca3be74917fefa2a301e4e0b94ec4
SSDEEP

196608:Z6Y2aQQ3l+DfyGwcVNQOVfW21X5Sp6GemDMPwuWuS9rSSgtVnKAihAie4iVx:EY2aQVDfD/zBlpfaMPDS9rGkNiVx

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2688	xcmd_beta.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2688	2276	xcmd_beta.exe	28
PID 2276 wrote to memory of 2688	2276	xcmd_beta.exe	28
PID 2276 wrote to memory of 2688	2276	xcmd_beta.exe	28

C:\Users\Admin\AppData\Local\Temp\xcmd_beta.exe
"C:\Users\Admin\AppData\Local\Temp\xcmd_beta.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\xcmd_beta.exe
  "C:\Users\Admin\AppData\Local\Temp\xcmd_beta.exe"
  2⤵
  - Loads dropped DLL
  PID:2688

C:\Users\Admin\AppData\Local\Temp\_MEI22762\python311.dll

Filesize
5.5MB

MD5
e2bd5ae53427f193b42d64b8e9bf1943

SHA1
7c317aad8e2b24c08d3b8b3fba16dd537411727f

SHA256
c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400

SHA512
ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036

Download Submit