0efe177726aa7d9bcfab85f55a035bb0e7b7bb0f26406c7f0d042a97a1dfb6bf

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 17:28

Target

0efe177726aa7d9bcfab85f55a035bb0e7b7bb0f26406c7f0d042a97a1dfb6bf.exe
Size

79KB
MD5

1208b5b8b60da6755b39435c720cfd5d
SHA1

e253d135758974ac321e94d717c88bae8659958f
SHA256

0efe177726aa7d9bcfab85f55a035bb0e7b7bb0f26406c7f0d042a97a1dfb6bf
SHA512

1678da8cec6caf4f058a707fb39d652dd1d1c7070b594c43d4fdd24a9eab2298e14d3f32460ae94820ed2ae54f432ce9b128319ff90685bd5d8a5bb3e744c9b2
SSDEEP

1536:zv/B5w5Dj5XJ+m6Ri+OQA8AkqUhMb2nuy5wgIP0CSJ+5yIB8GMGlZ5G:zv/B5w5D9XdGdqU7uy5w9WMyIN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2980	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2592	cmd.exe
2592	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2592	2020	0efe177726aa7d9bcfab85f55a035bb0e7b7bb0f26406c7f0d042a97a1dfb6bf.exe	29
PID 2020 wrote to memory of 2592	2020	0efe177726aa7d9bcfab85f55a035bb0e7b7bb0f26406c7f0d042a97a1dfb6bf.exe	29
PID 2020 wrote to memory of 2592	2020	0efe177726aa7d9bcfab85f55a035bb0e7b7bb0f26406c7f0d042a97a1dfb6bf.exe	29
PID 2020 wrote to memory of 2592	2020	0efe177726aa7d9bcfab85f55a035bb0e7b7bb0f26406c7f0d042a97a1dfb6bf.exe	29
PID 2592 wrote to memory of 2980	2592	cmd.exe	30
PID 2592 wrote to memory of 2980	2592	cmd.exe	30
PID 2592 wrote to memory of 2980	2592	cmd.exe	30
PID 2592 wrote to memory of 2980	2592	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\0efe177726aa7d9bcfab85f55a035bb0e7b7bb0f26406c7f0d042a97a1dfb6bf.exe
"C:\Users\Admin\AppData\Local\Temp\0efe177726aa7d9bcfab85f55a035bb0e7b7bb0f26406c7f0d042a97a1dfb6bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2980

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
68e34b5285e50f8a63c8c5cf20e19a56

SHA1
2d0de3ab3d7ee827081845b76f43f8cd41e95ca6

SHA256
14feb74519ef3b776e0ec0732c5e0116fb22363f224deed4c38e6ae98dd03f98

SHA512
509de41bc2e4be4d8c39e2ad5280d4971ba586c6bbebb8fd50f4daefefef342bdc86d367b9f34699ffd746882617f8af52389511f8f4ba2efd0bec7e362b61df

Download Submit
memory/2020-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2980-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download