cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b

Analysis

max time kernel
120s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 23:26

Target

cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe
Size

73KB
MD5

7ab1dd78de8c6989418cb7d016c0f714
SHA1

18e9604088617fe128b377524d9d70ddf7861eae
SHA256

cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b
SHA512

9d2cb5ec9b44fbbda49a90ef9a6b6c9865ebbe9ddbc36848f579d49571a6502330196d4aae1c0b1059f171306aa4ba04f8813ab22c4619c5759a04a0934b4114
SSDEEP

1536:hbt6TWFYUK5QPqfhVWbdsmA+RjPFLC+e5hA0ZGUGf2g:h5KRUNPqfcxA+HFshAOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2360	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2348	cmd.exe
2348	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2348	2488	cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe	30
PID 2488 wrote to memory of 2348	2488	cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe	30
PID 2488 wrote to memory of 2348	2488	cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe	30
PID 2488 wrote to memory of 2348	2488	cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe	30
PID 2348 wrote to memory of 2360	2348	cmd.exe	31
PID 2348 wrote to memory of 2360	2348	cmd.exe	31
PID 2348 wrote to memory of 2360	2348	cmd.exe	31
PID 2348 wrote to memory of 2360	2348	cmd.exe	31
PID 2360 wrote to memory of 2472	2360	[email protected]	32
PID 2360 wrote to memory of 2472	2360	[email protected]	32
PID 2360 wrote to memory of 2472	2360	[email protected]	32
PID 2360 wrote to memory of 2472	2360	[email protected]	32

C:\Users\Admin\AppData\Local\Temp\cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe
"C:\Users\Admin\AppData\Local\Temp\cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2472

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
7ce5fe1fb9255b2eab91272b334a331f

SHA1
ec8b356ae3ce1e6795249a230042f386042da7d8

SHA256
17617a64289ae8c37e959d3532fe7455c99276415d9659d35c2d464468fadf72

SHA512
dcdd68021ff75147679292356bc65b0f5f5f0f9a725bfb2d91a15df39a58b60f521267b14d44714e94718c62bbe3b21018ebbe30a3ec933103efd5f51e0290c8

Download Submit
memory/2360-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2488-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download