51885a3299e9fc3dbc6cb70dc3b5099a72523c34ffc4284b0d658714ef752f6c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 07:14

Target

b6d3c9eda404f30cdbdd8838a9a18060.exe
Size

7KB
MD5

b6d3c9eda404f30cdbdd8838a9a18060
SHA1

47582da13c97902844df63305f198ad2be929d2c
SHA256

51885a3299e9fc3dbc6cb70dc3b5099a72523c34ffc4284b0d658714ef752f6c
SHA512

26518ae7c41e2709f1ad6131505b3f544fec283e376e1edf3f69754ef06d719a1fda67ee6c4053285f46afee4941c0e4d110b0ce7fcc86562ff806e105f1c078
SSDEEP

192:LUbT6ffMF8uC3HhxPDE524w9pTr0QIPE/6xevoJJvv4JU7W:gbTp6q5ITr68/CppvIU7W

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2476	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2476	840	b6d3c9eda404f30cdbdd8838a9a18060.exe	29
PID 840 wrote to memory of 2476	840	b6d3c9eda404f30cdbdd8838a9a18060.exe	29
PID 840 wrote to memory of 2476	840	b6d3c9eda404f30cdbdd8838a9a18060.exe	29
PID 840 wrote to memory of 2476	840	b6d3c9eda404f30cdbdd8838a9a18060.exe	29

C:\Users\Admin\AppData\Local\Temp\b6d3c9eda404f30cdbdd8838a9a18060.exe
"C:\Users\Admin\AppData\Local\Temp\b6d3c9eda404f30cdbdd8838a9a18060.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c echo @echo off>"rm.bat"&echo :try>>"rm.bat"&echo @del /F /Q "C:\Users\Admin\AppData\Local\Temp\b6d3c9eda404f30cdbdd8838a9a18060.exe">>"rm.bat"&echo if exist "C:\Users\Admin\AppData\Local\Temp\b6d3c9eda404f30cdbdd8838a9a18060.exe" goto try>>"rm.bat"&"rm.bat"&@del /F /Q "rm.bat"
  2⤵
  - Deletes itself
  PID:2476

C:\Users\Admin\AppData\Local\Temp\rm.bat

Filesize
194B

MD5
da36fdbba5c2cea3bc2542d20651c09d

SHA1
03fddbcbd291e37265b7d74116984f354d270c11

SHA256
d9b021d55c19fd59d89ae3894fb534eac005bfd7ea1830e5d368c705b6b55ae6

SHA512
a3072f8be1940e74046e1895aeaa1fa095d80326ed384c0b0541b4dc6bf1fc594046161076c175744765c22453cb4c59fe13f9aded26d47c6d774781213a297f

Download Submit
memory/840-0-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/840-1-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download