0d53a1cd332e2327a96d03addac11e90aa1a119f1c9035bb03ad7cf5c6098687

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 11:41

Target

ddec4f0f200c6401440e94f9db8ab58c.exe
Size

92KB
MD5

ddec4f0f200c6401440e94f9db8ab58c
SHA1

f938552713be6226a7132cec221b4243a12a5b38
SHA256

0d53a1cd332e2327a96d03addac11e90aa1a119f1c9035bb03ad7cf5c6098687
SHA512

7183acf4f7535304cee4fe1667f413088bec51c67ee8eafd481db62c657c1981e8fd340403914c9cb6b62a4884cd9cf36a713fef65111f4fe21ebc78256f2e41
SSDEEP

1536:ZBwd7Knfg6GS/joyZ+fmFb/8cE1emozPcj4knTYVq+UM7E1CFcUm4KT8:8MfiENAOFDk2lkUVq+UMuycUX

Score

8^/10

evasion

Deletes itself 1 IoCs

pid	Process
2720	cmd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3004	ddec4f0f200c6401440e94f9db8ab58c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3004	2348	ddec4f0f200c6401440e94f9db8ab58c.exe	28
PID 2348 wrote to memory of 3004	2348	ddec4f0f200c6401440e94f9db8ab58c.exe	28
PID 2348 wrote to memory of 3004	2348	ddec4f0f200c6401440e94f9db8ab58c.exe	28
PID 2348 wrote to memory of 3004	2348	ddec4f0f200c6401440e94f9db8ab58c.exe	28
PID 3004 wrote to memory of 2720	3004	ddec4f0f200c6401440e94f9db8ab58c.exe	29
PID 3004 wrote to memory of 2720	3004	ddec4f0f200c6401440e94f9db8ab58c.exe	29
PID 3004 wrote to memory of 2720	3004	ddec4f0f200c6401440e94f9db8ab58c.exe	29
PID 3004 wrote to memory of 2720	3004	ddec4f0f200c6401440e94f9db8ab58c.exe	29

C:\Users\Admin\AppData\Local\Temp\ddec4f0f200c6401440e94f9db8ab58c.exe
"C:\Users\Admin\AppData\Local\Temp\ddec4f0f200c6401440e94f9db8ab58c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\ddec4f0f200c6401440e94f9db8ab58c.exe
  "C:\Users\Admin\AppData\Local\Temp\ddec4f0f200c6401440e94f9db8ab58c.exe" del
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\cmd.exe
    /c del C:\Users\Admin\AppData\Local\Temp\DDEC4F~1.EXE.tmp >> NUL
    3⤵
    - Deletes itself
    PID:2720