3ee0a25b103ed6eb1b6a7336f989ea97b59708348af75ec528fc08345c2c4b74

Analysis

max time kernel
123s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 05:06

Target

ca8dea5c6aae8755a89dc2d3a19ccc20.exe
Size

168KB
MD5

ca8dea5c6aae8755a89dc2d3a19ccc20
SHA1

cca9a08c1dd18e12b0a2895e313965e6ed5a7d35
SHA256

3ee0a25b103ed6eb1b6a7336f989ea97b59708348af75ec528fc08345c2c4b74
SHA512

88d7d0d82d7d07390f5afe66f5ca1d66a157be29ae6c567b8a7775db14341964232459697198fd9d0ffd9084b8496f54b3dbadc2efcc5e2bec54b92f7cddb32c
SSDEEP

3072:Mdg1S8uYlvQj61+6YtHlqJyKIpoa4nHza5xr+muF6PTuj2E/E0BKkUJKKIglX61:L1BlMlntFqJyKIB4nH0km66iacE0BKZE

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2320	ca8dea5c6aae8755a89dc2d3a19ccc20.exe

Loads dropped DLL 2 IoCs

pid	Process
1968	ca8dea5c6aae8755a89dc2d3a19ccc20.exe
1968	ca8dea5c6aae8755a89dc2d3a19ccc20.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ca8dea5c6aae8755a89dc2d3a19ccc20.exe	ca8dea5c6aae8755a89dc2d3a19ccc20.exe
File opened for modification	C:\Windows\SysWOW64\ca8dea5c6aae8755a89dc2d3a19ccc20.exe	ca8dea5c6aae8755a89dc2d3a19ccc20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2320	1968	ca8dea5c6aae8755a89dc2d3a19ccc20.exe	28
PID 1968 wrote to memory of 2320	1968	ca8dea5c6aae8755a89dc2d3a19ccc20.exe	28
PID 1968 wrote to memory of 2320	1968	ca8dea5c6aae8755a89dc2d3a19ccc20.exe	28
PID 1968 wrote to memory of 2320	1968	ca8dea5c6aae8755a89dc2d3a19ccc20.exe	28

C:\Users\Admin\AppData\Local\Temp\ca8dea5c6aae8755a89dc2d3a19ccc20.exe
"C:\Users\Admin\AppData\Local\Temp\ca8dea5c6aae8755a89dc2d3a19ccc20.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\ca8dea5c6aae8755a89dc2d3a19ccc20.exe
  C:\Windows\system32\ca8dea5c6aae8755a89dc2d3a19ccc20.exe
  2⤵
  - Executes dropped EXE
  PID:2320

\Windows\SysWOW64\ca8dea5c6aae8755a89dc2d3a19ccc20.exe

Filesize
168KB

MD5
ca8dea5c6aae8755a89dc2d3a19ccc20

SHA1
cca9a08c1dd18e12b0a2895e313965e6ed5a7d35

SHA256
3ee0a25b103ed6eb1b6a7336f989ea97b59708348af75ec528fc08345c2c4b74

SHA512
88d7d0d82d7d07390f5afe66f5ca1d66a157be29ae6c567b8a7775db14341964232459697198fd9d0ffd9084b8496f54b3dbadc2efcc5e2bec54b92f7cddb32c

Download Submit
memory/1968-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1968-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1968-4-0x0000000001D40000-0x0000000001DA7000-memory.dmp

Filesize
412KB

Download
memory/1968-10-0x0000000001D40000-0x0000000001DA7000-memory.dmp

Filesize
412KB

Download
memory/1968-15-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2320-13-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2320-14-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2320-12-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download