42c767d9a6fcf327039c6e4d204a7fc536005e54b81876b4c6d7c7873d46ca1f

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 05:33

Target

baa3d85ae9ac5d21aaa38ab87b9c5bd8.exe
Size

1.0MB
MD5

baa3d85ae9ac5d21aaa38ab87b9c5bd8
SHA1

101d864536cbb3bd9632b02cbd75fa39d9b63c47
SHA256

42c767d9a6fcf327039c6e4d204a7fc536005e54b81876b4c6d7c7873d46ca1f
SHA512

4de523f9db1e4afcb017f345d90b8c685fe64d8c9c7316db02cfdb98577eae872fb8f637af59d5d4283ab118370d5fe673e7aa2e2734b4f5e507db31256a1d2c
SSDEEP

24576:7zXKqa8SEijjC+37liXbLbklmfB6/tbQdSmKeJ0xjOR:7z6qaakjC+3srLAKB61bQd3Keao

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1940	fraxsda.exe

Loads dropped DLL 1 IoCs

pid	Process
2184	baa3d85ae9ac5d21aaa38ab87b9c5bd8.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\cyuptmnx\fraxsda.exe	baa3d85ae9ac5d21aaa38ab87b9c5bd8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1940	2184	baa3d85ae9ac5d21aaa38ab87b9c5bd8.exe	28
PID 2184 wrote to memory of 1940	2184	baa3d85ae9ac5d21aaa38ab87b9c5bd8.exe	28
PID 2184 wrote to memory of 1940	2184	baa3d85ae9ac5d21aaa38ab87b9c5bd8.exe	28
PID 2184 wrote to memory of 1940	2184	baa3d85ae9ac5d21aaa38ab87b9c5bd8.exe	28

C:\Users\Admin\AppData\Local\Temp\baa3d85ae9ac5d21aaa38ab87b9c5bd8.exe
"C:\Users\Admin\AppData\Local\Temp\baa3d85ae9ac5d21aaa38ab87b9c5bd8.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\cyuptmnx\fraxsda.exe
  "C:\Program Files (x86)\cyuptmnx\fraxsda.exe"
  2⤵
  - Executes dropped EXE
  PID:1940

C:\Program Files (x86)\cyuptmnx\fraxsda.exe

Filesize
512KB

MD5
27d07b2beeaf6976b6f11fe3ce15cc12

SHA1
6691d3cbb87f55fe6ce51114694ac564b8794885

SHA256
e1dee8ab17d8febf594a0598e3528c557d284215fe822e6eba6c0bb5ba8bbc32

SHA512
7fdbd3872ac76f6a533f7101680b08755b383bef100e06a9ca830ff7c2ffe1cb2a595f1e1633247a68819d02ec11c7d0633ff468412c1281685cc967cd2e6e5e

Download Submit
\Program Files (x86)\cyuptmnx\fraxsda.exe

Filesize
832KB

MD5
4d72ff0ea712308bc81ea2f490e144d9

SHA1
c20e712dc9cd09e1893a26150a3fddacce7ddbf4

SHA256
f94f1591fa1a7dbe2e139c913c5570d6da4435d9e8f5faf0cfa615a99995ca65

SHA512
249daa32106783027435c0ec90541bdf10934400861d3efd0bf79a6150c1de6af1e12f01b5f75cec3a397aad60de2ca6cfb2d7744bcd66a2dead3e6316947a06

Download Submit
memory/1940-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2184-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2184-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2184-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2184-7-0x0000000000330000-0x00000000003C4000-memory.dmp

Filesize
592KB

Download