bf7e94e006f3f7162fe9afbba7d781ea0239e7f9228910a2a72685941163b883

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 18:17

Target

d430b5b094c49acb4e0c041560129e42.exe
Size

18KB
MD5

d430b5b094c49acb4e0c041560129e42
SHA1

f0c13b23d8f9f0d7374235239531f98af413050d
SHA256

bf7e94e006f3f7162fe9afbba7d781ea0239e7f9228910a2a72685941163b883
SHA512

d627ddee6b883c36efae4466687d4adbb60a7252d90aae29e962a96482aa45614d19df05a089fdba3bec0fa1b108d992d2dbcba7558d648f28b33789593ec47a
SSDEEP

384:FnALRnfbBz8qotymwrqhhqrOb/fz7fGjPTmerQVFZQcaqSUhqTB:m1TmqwymWAtnG3me0/Z3DSiqd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2696	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2696	2068	d430b5b094c49acb4e0c041560129e42.exe	28
PID 2068 wrote to memory of 2696	2068	d430b5b094c49acb4e0c041560129e42.exe	28
PID 2068 wrote to memory of 2696	2068	d430b5b094c49acb4e0c041560129e42.exe	28
PID 2068 wrote to memory of 2696	2068	d430b5b094c49acb4e0c041560129e42.exe	28

C:\Users\Admin\AppData\Local\Temp\d430b5b094c49acb4e0c041560129e42.exe
"C:\Users\Admin\AppData\Local\Temp\d430b5b094c49acb4e0c041560129e42.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\b.bat "C:\Users\Admin\AppData\Local\Temp\d430b5b094c49acb4e0c041560129e42.exe"
  2⤵
  - Deletes itself
  PID:2696

C:\Users\Admin\AppData\Local\Temp\b.bat

Filesize
56B

MD5
53bfe5e56ee7fe6f911a69d63ec75bb0

SHA1
0749a7e178f0cf1bec7560adc3dffeafba8bcd59

SHA256
2393a34e810100dad1765d5f5d6e732a3288257381897fdbe2054de7044b7af6

SHA512
a3fb118e01a6b04695b8999cdaa2eae525604bef398945d31ebdc318d1b15b89fb61b4f15139f78651047a697247b496690077bef3657c1738575d83a10262e6

Download Submit