fe599de074ab1e5e9f89ad14923496845a871a6562942d46fe54ecfe934ab20e

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 13:08

Target

beaf598a685a1f7952711604a2b623d4.exe
Size

362KB
MD5

beaf598a685a1f7952711604a2b623d4
SHA1

9dace68efd68131518a2e333886413fbd4b9872c
SHA256

fe599de074ab1e5e9f89ad14923496845a871a6562942d46fe54ecfe934ab20e
SHA512

5b3cb9973fce8ef3b54012d395e0a94823c62b0e0cb5a694d5a2abff11378e3dd1c9466658503fc7f5541a29ddbd570f98a127c9227a4c1ea867ef94107121c4
SSDEEP

6144:N+I8EXLiClyXPH6kZ7pYEepYzd7ze0zaLmPZXNPLcY4g9zaRC7wRhmK:N+yJG/pY2d7sqvcYjzacqhm

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2572	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3040	setuplog.bat

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\setuplog.bat	beaf598a685a1f7952711604a2b623d4.exe
File opened for modification	C:\Windows\setuplog.bat	beaf598a685a1f7952711604a2b623d4.exe
File created	C:\Windows\setuplog.DLL	setuplog.bat
File opened for modification	C:\Windows\setuplog.DLL	setuplog.bat
File created	C:\Windows\uninstal.bat	beaf598a685a1f7952711604a2b623d4.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3040	setuplog.bat

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2572	1224	beaf598a685a1f7952711604a2b623d4.exe	29
PID 1224 wrote to memory of 2572	1224	beaf598a685a1f7952711604a2b623d4.exe	29
PID 1224 wrote to memory of 2572	1224	beaf598a685a1f7952711604a2b623d4.exe	29
PID 1224 wrote to memory of 2572	1224	beaf598a685a1f7952711604a2b623d4.exe	29
PID 1224 wrote to memory of 2572	1224	beaf598a685a1f7952711604a2b623d4.exe	29
PID 1224 wrote to memory of 2572	1224	beaf598a685a1f7952711604a2b623d4.exe	29
PID 1224 wrote to memory of 2572	1224	beaf598a685a1f7952711604a2b623d4.exe	29
PID 3040 wrote to memory of 1188	3040	setuplog.bat	21

C:\Windows\setuplog.bat

Filesize
362KB

MD5
beaf598a685a1f7952711604a2b623d4

SHA1
9dace68efd68131518a2e333886413fbd4b9872c

SHA256
fe599de074ab1e5e9f89ad14923496845a871a6562942d46fe54ecfe934ab20e

SHA512
5b3cb9973fce8ef3b54012d395e0a94823c62b0e0cb5a694d5a2abff11378e3dd1c9466658503fc7f5541a29ddbd570f98a127c9227a4c1ea867ef94107121c4

Download Submit
C:\Windows\uninstal.bat

Filesize
190B

MD5
dbd69fcfa2ffd31d9a6d5a5332691226

SHA1
3f864f752fa14abaa431ee2e5abd9ef3534ab0ba

SHA256
6c1abd549eab8c5d4fab36736a8d1ff6f79bd8b239eb1eb2aa590b2d9dad4d15

SHA512
c676a01746d9287bb9e2d5a100f5aa7feca6d46239504f76e2ec32471df3749b8d2fb600f08dccd9fb487b39f1edc0ff8acb06e0aac2bd6727e4b8a8ea0b00d4

Download Submit
memory/1188-18-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

Filesize
4KB

Download
memory/1224-2-0x0000000013140000-0x0000000013262000-memory.dmp

Filesize
1.1MB

Download
memory/1224-16-0x0000000013140000-0x0000000013262000-memory.dmp

Filesize
1.1MB

Download
memory/3040-4-0x0000000013140000-0x0000000013262000-memory.dmp

Filesize
1.1MB

Download
memory/3040-6-0x0000000013140000-0x0000000013262000-memory.dmp

Filesize
1.1MB

Download
memory/3040-20-0x0000000013140000-0x0000000013262000-memory.dmp

Filesize
1.1MB

Download