90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 00:03

Target

90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe
Size

73KB
MD5

8110775f52b855290b0a9207899fda17
SHA1

24e3090532b8e091e0fed048010b3ffbed5a28ce
SHA256

90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d
SHA512

6b698fe034374f9ebd0d5bba7efc73f439bab75eddbf840629face9da7dd0d2698ffa7d9f68da5434cf79a9a219be385cc1c819972bbe51c47b60ee954dce816
SSDEEP

1536:hblJihw6Fovqos7K5QPqfhVWbdsmA+RjPFLC+e5hNT0ZGUGf2g:h76S9s7NPqfcxA+HFshFOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2636	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2088	cmd.exe
2088	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2088	2080	90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe	29
PID 2080 wrote to memory of 2088	2080	90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe	29
PID 2080 wrote to memory of 2088	2080	90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe	29
PID 2080 wrote to memory of 2088	2080	90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe	29
PID 2088 wrote to memory of 2636	2088	cmd.exe	30
PID 2088 wrote to memory of 2636	2088	cmd.exe	30
PID 2088 wrote to memory of 2636	2088	cmd.exe	30
PID 2088 wrote to memory of 2636	2088	cmd.exe	30
PID 2636 wrote to memory of 2000	2636	[email protected]	31
PID 2636 wrote to memory of 2000	2636	[email protected]	31
PID 2636 wrote to memory of 2000	2636	[email protected]	31
PID 2636 wrote to memory of 2000	2636	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe
"C:\Users\Admin\AppData\Local\Temp\90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 16256.exe
      4⤵
      PID:2000

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
423448d9782bf0cefc50248f34f2818f

SHA1
656cdbfa6e1837bd1f59abe62013821a6571d355

SHA256
6b41fed56e862f7cc97a739bb0e8ec2c7be362bf55724120551e42cca7950568

SHA512
0555b73c552ab099d604ea3adc72822de5ce5417487ff2af8fc17eacb03fd51ea0ee0af5a195d506a6cdd1c8454a456cfdcd8eaad67213325ff5484bc7d0ace4

Download Submit
memory/2080-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2636-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download