614980c151bd95cf549be843fb027875ac2f3b31b4401b862eb09f1a20698695

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 05:00

Target

d54372ef94ef0a1fc6417fadd11d7ce1.exe
Size

1.1MB
MD5

d54372ef94ef0a1fc6417fadd11d7ce1
SHA1

1ecf93ecd692f695ad9a40493b0c62141181f202
SHA256

614980c151bd95cf549be843fb027875ac2f3b31b4401b862eb09f1a20698695
SHA512

47750646d08ed47cd9173ff8ecfa1797178bebddf07a2730a14ce014eb8958beed5995e7b72ee45e0e98e936de33a297e90dd4a134362b4bcca4b8c7f51d072c
SSDEEP

24576:qKeyxTAJj7PV/s4k+oW6itPl6pMurAJYMTIbtwYWVkO42:qKeyRA/t6+PMp2FStF2kW

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2516	bub.exe

Loads dropped DLL 1 IoCs

pid	Process
2936	d54372ef94ef0a1fc6417fadd11d7ce1.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\jdnbispiqo\bub.exe	d54372ef94ef0a1fc6417fadd11d7ce1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2516	2936	d54372ef94ef0a1fc6417fadd11d7ce1.exe	28
PID 2936 wrote to memory of 2516	2936	d54372ef94ef0a1fc6417fadd11d7ce1.exe	28
PID 2936 wrote to memory of 2516	2936	d54372ef94ef0a1fc6417fadd11d7ce1.exe	28
PID 2936 wrote to memory of 2516	2936	d54372ef94ef0a1fc6417fadd11d7ce1.exe	28

C:\Users\Admin\AppData\Local\Temp\d54372ef94ef0a1fc6417fadd11d7ce1.exe
"C:\Users\Admin\AppData\Local\Temp\d54372ef94ef0a1fc6417fadd11d7ce1.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\jdnbispiqo\bub.exe
  "C:\Program Files (x86)\jdnbispiqo\bub.exe"
  2⤵
  - Executes dropped EXE
  PID:2516

C:\Program Files (x86)\jdnbispiqo\bub.exe

Filesize
1.1MB

MD5
fa2d489ff0a3bd28a7578fcd3533d155

SHA1
00b5cb3480d25d780c5cdd8a4d635795b48835ff

SHA256
f44dd86139ac1f8b3136269a227353dcb489a755a70e7975324e26471632dfe7

SHA512
2df8bef593ada7ac0a5a40b0a1efe17a5e5f3ee23c6424da62e4d7851f00cacd770c07c68295b07e9c281e30af433b33c59ec079595b3556e5b4d81c152971fb

Download Submit
memory/2516-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2936-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2936-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2936-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download