71fa3de0c8cad03a07907393714fd607841d0e8f7912a09ed8b4129bf4521e83

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 20:11

Target

71fa3de0c8cad03a07907393714fd607841d0e8f7912a09ed8b4129bf4521e83.exe
Size

99KB
MD5

d15d8b590feb07f09ed7fea980c8a4bc
SHA1

13b75454ce609c0a1fa08e8bdaf62a743b03b633
SHA256

71fa3de0c8cad03a07907393714fd607841d0e8f7912a09ed8b4129bf4521e83
SHA512

412b7779d71040341259e8ab5897ddb1f214969991efa4058de304e617b6af10d2f1be2c4671c92fea78c197e33c89b0f1f0a52b02997bc0a2b82918da733a86
SSDEEP

1536:3nrhX6MhUYlmVTrufyOzy7kgzHKza5SMwXRTWxkwTl8YTi1GNMiW/65MwFyiq:Xh6M5l+fufyVzHKztCpaAgv

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2972	guzakbet.exe

Loads dropped DLL 2 IoCs

pid	Process
2212	71fa3de0c8cad03a07907393714fd607841d0e8f7912a09ed8b4129bf4521e83.exe
2212	71fa3de0c8cad03a07907393714fd607841d0e8f7912a09ed8b4129bf4521e83.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2972	2212	71fa3de0c8cad03a07907393714fd607841d0e8f7912a09ed8b4129bf4521e83.exe	28
PID 2212 wrote to memory of 2972	2212	71fa3de0c8cad03a07907393714fd607841d0e8f7912a09ed8b4129bf4521e83.exe	28
PID 2212 wrote to memory of 2972	2212	71fa3de0c8cad03a07907393714fd607841d0e8f7912a09ed8b4129bf4521e83.exe	28
PID 2212 wrote to memory of 2972	2212	71fa3de0c8cad03a07907393714fd607841d0e8f7912a09ed8b4129bf4521e83.exe	28

C:\Users\Admin\AppData\Local\Temp\71fa3de0c8cad03a07907393714fd607841d0e8f7912a09ed8b4129bf4521e83.exe
"C:\Users\Admin\AppData\Local\Temp\71fa3de0c8cad03a07907393714fd607841d0e8f7912a09ed8b4129bf4521e83.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
  C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
  2⤵
  - Executes dropped EXE
  PID:2972

C:\Users\Admin\AppData\Local\Temp\guzakbet.exe

Filesize
99KB

MD5
96c5c2492f70d016e78acfd9722fe97c

SHA1
0467aee44e7a36a8dd76b2a0150ca07878136d03

SHA256
9a1ec1ec895bf90c60b66bb6daa44f442bf82b7af107f5f69e655421d963f9bc

SHA512
2fb466374f8bd13e67b5bd3b11fda2087667191438ca9a7e594e118ec720db481e5b395d1fcc84431ca38362181ffbeb083d0a117178d9841e155eb3dd7417dd

Download Submit
memory/2212-1-0x00000000009E0000-0x00000000009F6000-memory.dmp

Filesize
88KB

Download
memory/2212-11-0x00000000009E0000-0x00000000009F6000-memory.dmp

Filesize
88KB

Download
memory/2972-10-0x0000000000320000-0x0000000000336000-memory.dmp

Filesize
88KB

Download