d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 09:52

Target

d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe
Size

51KB
MD5

4de91c8119233a12715ba542b1c9b424
SHA1

e9dc178ee826a3289d244389e59caef707811ad3
SHA256

d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3
SHA512

d70286ad1955acce9c9bd5d74db6501de6822c7220a57b11507c49f369d25cb0daf7716a4b56d66659568741028d255baa903b8645dcbad3e17c72215d510795
SSDEEP

768:0MXcbpW3DzHcCuO1RwXvHt7VNufGSgoujzkw8f7eObW7i8Goo:0MMbpWT/uORGP/Nu2cHNoo

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2836	ofylywo.exe

Loads dropped DLL 1 IoCs

pid	Process
2820	d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2836	2820	d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe	28
PID 2820 wrote to memory of 2836	2820	d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe	28
PID 2820 wrote to memory of 2836	2820	d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe	28
PID 2820 wrote to memory of 2836	2820	d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe	28

C:\Users\Admin\AppData\Local\Temp\d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe
"C:\Users\Admin\AppData\Local\Temp\d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  2⤵
  - Executes dropped EXE
  PID:2836

C:\Users\Admin\AppData\Local\Temp\ofylywo.exe

Filesize
51KB

MD5
fed8644b20d962ddc36889604fe56560

SHA1
cbaffc7e9d2549bca4928349c5360ae2d0ada0c5

SHA256
094433306c74909ec37d1a562545fa6b1055d7ee11cf99a1e6aed425aca5e328

SHA512
6dfb317b468b1498c9f27f8514c4a22dc345b246757e92ff6a397c45180b92da2ac3cdacd3f28cc4c54d5e364bc9f05bf2f03662b73a9c708f9dd1eb5996a65a

Download Submit
memory/2820-1-0x0000000000A40000-0x0000000000A4C000-memory.dmp

Filesize
48KB

Download
memory/2836-6-0x0000000000FF0000-0x0000000000FFC000-memory.dmp

Filesize
48KB

Download