004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 18:33

Target

004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe
Size

73KB
MD5

af6a8908b6a73d34a56bed9d479c894b
SHA1

ecebbee3b694633645d84099bff439992ec40353
SHA256

004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce
SHA512

3776cb4e8b1825cab43cdd9fe5bb51bf3d8f286bf28a56638614984d1e6463df745568b731dc30c1cf051556b5b2b36ebb03d5d7a237eea7ec6b40a9482626cb
SSDEEP

1536:hbkaWqFWZmj2aZK5QPqfhVWbdsmA+RjPFLC+e5h4P0ZGUGf2g:hwa5XCONPqfcxA+HFsh4POg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2168	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1232	cmd.exe
1232	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1232	2044	004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe	29
PID 2044 wrote to memory of 1232	2044	004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe	29
PID 2044 wrote to memory of 1232	2044	004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe	29
PID 2044 wrote to memory of 1232	2044	004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe	29
PID 1232 wrote to memory of 2168	1232	cmd.exe	30
PID 1232 wrote to memory of 2168	1232	cmd.exe	30
PID 1232 wrote to memory of 2168	1232	cmd.exe	30
PID 1232 wrote to memory of 2168	1232	cmd.exe	30
PID 2168 wrote to memory of 2384	2168	[email protected]	31
PID 2168 wrote to memory of 2384	2168	[email protected]	31
PID 2168 wrote to memory of 2384	2168	[email protected]	31
PID 2168 wrote to memory of 2384	2168	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe
"C:\Users\Admin\AppData\Local\Temp\004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2384

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
84285d60ced070cf799a661c280c8bd3

SHA1
0299b7cafb4b18868883de9ee1104411b5e4a66b

SHA256
ea8886af748edc95a9f60e76bd4b1680253e7b9ef080460132b9c57438ac692b

SHA512
29966aac93bf0cc5cfb2f530c31dd31be01533f042d9cd30a4a177aa0565d0cdefc9ec688b4211fd48858d0e0a020f6d63326d173385f9ff841e6e71a6ef2875

Download Submit
memory/2044-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2168-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download