f8cecafca5045ed5f7045dfc33af579b738fb022f19a1e9dfe2484fdc00306aa

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 02:05

Target

f8cecafca5045ed5f7045dfc33af579b738fb022f19a1e9dfe2484fdc00306aa.exe
Size

79KB
MD5

28b548ebdef64081f9b32cd7f054336e
SHA1

fdd42f20733fb0d93642c23b8743cac0bf636e27
SHA256

f8cecafca5045ed5f7045dfc33af579b738fb022f19a1e9dfe2484fdc00306aa
SHA512

e0020f274bd787a82badd4c2ee79658d73753a6593064c0648a154f85a138751c676bb6142aaa2ae18ac439a41e00a822e1cf13f59b3385e8aaf4fd28056ca0b
SSDEEP

1536:zvO/iWQN7sVqtRZuuOQA8AkqUhMb2nuy5wgIP0CSJ+5yVB8GMGlZ5G:zvO6LP7Z+GdqU7uy5w9WMyVN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2820	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2816	cmd.exe
2816	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2816	2964	f8cecafca5045ed5f7045dfc33af579b738fb022f19a1e9dfe2484fdc00306aa.exe	29
PID 2964 wrote to memory of 2816	2964	f8cecafca5045ed5f7045dfc33af579b738fb022f19a1e9dfe2484fdc00306aa.exe	29
PID 2964 wrote to memory of 2816	2964	f8cecafca5045ed5f7045dfc33af579b738fb022f19a1e9dfe2484fdc00306aa.exe	29
PID 2964 wrote to memory of 2816	2964	f8cecafca5045ed5f7045dfc33af579b738fb022f19a1e9dfe2484fdc00306aa.exe	29
PID 2816 wrote to memory of 2820	2816	cmd.exe	30
PID 2816 wrote to memory of 2820	2816	cmd.exe	30
PID 2816 wrote to memory of 2820	2816	cmd.exe	30
PID 2816 wrote to memory of 2820	2816	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\f8cecafca5045ed5f7045dfc33af579b738fb022f19a1e9dfe2484fdc00306aa.exe
"C:\Users\Admin\AppData\Local\Temp\f8cecafca5045ed5f7045dfc33af579b738fb022f19a1e9dfe2484fdc00306aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2820

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
4a489ae3b38f92d6bfd21175fc44a3d6

SHA1
c92ac5e9eee6233863dadb5d882820b2e116fc8c

SHA256
912e9df9f383bd7dd9fe8cbba76715cf2f4cc698ceddf1edd5ab39411af21ca2

SHA512
9b6e0bbad661f52cd9c4fca836f79712461cf2105fdf6ac9f433d81e84856942d8d87471f0d86aaae50c5158fb2a50f649194c71dbd7faac27b7f10cf6c257d2

Download Submit
memory/2820-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2964-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download