a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 21:34

Target

a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe
Size

73KB
MD5

c54181aab1a2fe0fc4d1035a81f21597
SHA1

f07695831b6e973359a71d1827e0554590bfc298
SHA256

a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee
SHA512

ef7fbafb12e3dce81b76ab53bd80e535bb8ae3bdf0b9087837b2c6705cc888f901ef51adf7dc81e93a6c73905968e0b35e8d4c619aee167e3b85d53643cd7320
SSDEEP

1536:hb/uojkcN6Lb/J5RhwK5QPqfhVWbdsmA+RjPFLC+e5hg0ZGUGf2g:hDuojk7MNPqfcxA+HFshgOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2112	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2016	cmd.exe
2016	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2016	2980	a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe	29
PID 2980 wrote to memory of 2016	2980	a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe	29
PID 2980 wrote to memory of 2016	2980	a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe	29
PID 2980 wrote to memory of 2016	2980	a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe	29
PID 2016 wrote to memory of 2112	2016	cmd.exe	30
PID 2016 wrote to memory of 2112	2016	cmd.exe	30
PID 2016 wrote to memory of 2112	2016	cmd.exe	30
PID 2016 wrote to memory of 2112	2016	cmd.exe	30
PID 2112 wrote to memory of 3052	2112	[email protected]	31
PID 2112 wrote to memory of 3052	2112	[email protected]	31
PID 2112 wrote to memory of 3052	2112	[email protected]	31
PID 2112 wrote to memory of 3052	2112	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe
"C:\Users\Admin\AppData\Local\Temp\a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3052

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
1102ed868651f3bbc9843a942c68406b

SHA1
d8e659f11f681a557ad875e3b845fac7b3d7be3e

SHA256
e37a226b665edb953908ccba0248486bcfad3ccb81ea2c5ea0efa27de3cc36ae

SHA512
32552f7fe905c5f0c9c2584bdf372566aaa10640cde0f2e67a7887930e4ff8cd0952d5b3e949b6a722bbdbe44e38f9c8fa691f7c272f35a803f1cc7e05ee939c

Download Submit
memory/2112-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2980-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download