76c86cfa4f00296d4fc9aa3cc62627237dcc2ad41f301f45cccc47fbbb0541b2

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 23:01

Target

76c86cfa4f00296d4fc9aa3cc62627237dcc2ad41f301f45cccc47fbbb0541b2.exe
Size

73KB
MD5

79942c1767f34f79a77a581a5e3db552
SHA1

1323eaa1c1c7fa3089232d82acc9b93313ba1553
SHA256

76c86cfa4f00296d4fc9aa3cc62627237dcc2ad41f301f45cccc47fbbb0541b2
SHA512

cdb544732006fb14f2323b4e0eebfd02de74f04f3fd9b083475962baa2201f33bdfa7483c51cd6175d26c7af7d2903ceb571f7e9b56950011c5523f8c2396245
SSDEEP

1536:hb6iUCLptK5QPqfhVWbdsmA+RjPFLC+e5hD0ZGUGf2g:hDvptNPqfcxA+HFshDOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2788	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2920	cmd.exe
2920	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2920	2916	76c86cfa4f00296d4fc9aa3cc62627237dcc2ad41f301f45cccc47fbbb0541b2.exe	29
PID 2916 wrote to memory of 2920	2916	76c86cfa4f00296d4fc9aa3cc62627237dcc2ad41f301f45cccc47fbbb0541b2.exe	29
PID 2916 wrote to memory of 2920	2916	76c86cfa4f00296d4fc9aa3cc62627237dcc2ad41f301f45cccc47fbbb0541b2.exe	29
PID 2916 wrote to memory of 2920	2916	76c86cfa4f00296d4fc9aa3cc62627237dcc2ad41f301f45cccc47fbbb0541b2.exe	29
PID 2920 wrote to memory of 2788	2920	cmd.exe	30
PID 2920 wrote to memory of 2788	2920	cmd.exe	30
PID 2920 wrote to memory of 2788	2920	cmd.exe	30
PID 2920 wrote to memory of 2788	2920	cmd.exe	30
PID 2788 wrote to memory of 3040	2788	[email protected]	31
PID 2788 wrote to memory of 3040	2788	[email protected]	31
PID 2788 wrote to memory of 3040	2788	[email protected]	31
PID 2788 wrote to memory of 3040	2788	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\76c86cfa4f00296d4fc9aa3cc62627237dcc2ad41f301f45cccc47fbbb0541b2.exe
"C:\Users\Admin\AppData\Local\Temp\76c86cfa4f00296d4fc9aa3cc62627237dcc2ad41f301f45cccc47fbbb0541b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3040

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
2f791805d90bab832cafea5a045f2a36

SHA1
c04011b0d278e4329b77cf397e4a76d56c6bf349

SHA256
e40115b35a4c0ef7325fedd6076a1fbcac6f9875a724fe0e86b4b6794f1b3ab8

SHA512
7889a89a01e09586545cd1d756b3eefbd5183dfa9a2bc07b5c8757a36c9d61bbb91527e68022f217c50fdd7068e066eb12b3dbafee066f6899bdc7fa8b50bd03

Download Submit
memory/2788-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2916-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download