ac337efd7c48119844958675acb785741108f8ba41acd53ad4a7659c9cd2d2d9

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 22:27

Target
rdns.exe
Size 80KB
Sample240406-2c418acg7x
SHA256 77e295dc521ad53cf422f892685ce70655b4c9ea7086bcfc12cbf872f4b3e8a1
MD5 0d6fda58fcfa09839191731811f6ebf0
SHA1 579ebe643129f5e5d6773a67033af99846b74360
SHA512 23c0b87bd13a564459882abd7ca94211e5773d30a8c628840749e9d3eec66095f0a9c16a2934925913a839e3ce28124b2e8ac06b7f686cc44b14425f070c8b82
SSDEEP 1536:GzFZRPPgttvJ2F2X1BEV8f1ik/P7Gp7tx2/QBGrYltuy4L:GzFbPwm04KNYxx2/HYltY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 2312	1160	rdns.exe	28
PID 1160 wrote to memory of 2312	1160	rdns.exe	28
PID 1160 wrote to memory of 2312	1160	rdns.exe	28
PID 1160 wrote to memory of 2312	1160	rdns.exe	28

C:\Users\Admin\AppData\Local\Temp\rdns.exe
"C:\Users\Admin\AppData\Local\Temp\rdns.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\rdns.exe
  C:\Users\Admin\AppData\Local\Temp\rdns.exe -bkg
  2⤵
  PID:2312

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\stbF1FE.tmp\setup.exe
Size 763B
SHA256 67d646e88c29a7f9182ba5937c66590005204484d4c41c36a99d5b38ec1a4543
MD5 d5d5c4344294d02789b93e27456049a5
SHA1 32300d9efa9d5952cbfcbb18336beb7d46f24f58
SHA512 ede1418125fe3da49981e70c4a9bf991d088dd989832780cad62daf9db597833d0606137846ff6d777fe26f394eda542eaeecc86cae75cf92d2a88cbd2e6b88f
MD5 SHA1 SHA512

Submit Download