609331a41e4e28125446731c27daa5d48537e424066dc00c9af45d423d9b5c7a

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 03:00

Target

b873c82dd91fba08d60d05219accd91abea11a180b7d57b19442c2f31e4b9655.exe
Size

5.5MB
MD5

7034268d1c52539ea0cd48fd33ae43c4
SHA1

5e19384b4459a758c7cf642e0e52d8fbaa2f03f7
SHA256

b873c82dd91fba08d60d05219accd91abea11a180b7d57b19442c2f31e4b9655
SHA512

c7f36f3d018abd24d8de0aa6a848e3a79693c61ccd906902f2912e310117fc1243bb3c8f45b01475a103ad83bcc2e3f423e814ccf990e6534f5894797663b719
SSDEEP

49152:uSD/kJ+L45A98KOUXb2/A/L0BKV3j/5hpFFTxDBUZxPRfFB7ljNhXQbD2CVhuU1w:UJ+kBKJXb2/4bwxPRvrCFgfMxq

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2852	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1988	timeout.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2852	2676	b873c82dd91fba08d60d05219accd91abea11a180b7d57b19442c2f31e4b9655.exe	28
PID 2676 wrote to memory of 2852	2676	b873c82dd91fba08d60d05219accd91abea11a180b7d57b19442c2f31e4b9655.exe	28
PID 2676 wrote to memory of 2852	2676	b873c82dd91fba08d60d05219accd91abea11a180b7d57b19442c2f31e4b9655.exe	28
PID 2676 wrote to memory of 2852	2676	b873c82dd91fba08d60d05219accd91abea11a180b7d57b19442c2f31e4b9655.exe	28
PID 2852 wrote to memory of 1988	2852	cmd.exe	30
PID 2852 wrote to memory of 1988	2852	cmd.exe	30
PID 2852 wrote to memory of 1988	2852	cmd.exe	30
PID 2852 wrote to memory of 1988	2852	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\b873c82dd91fba08d60d05219accd91abea11a180b7d57b19442c2f31e4b9655.exe
"C:\Users\Admin\AppData\Local\Temp\b873c82dd91fba08d60d05219accd91abea11a180b7d57b19442c2f31e4b9655.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c timeout /t 3 & del /q "C:\Users\Admin\AppData\Local\Temp\b873c82dd91fba08d60d05219accd91abea11a180b7d57b19442c2f31e4b9655.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:1988