58691af22fbd8b84e66bd2d90b606ca66255319bf6077887fa784b83587c8ae3

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 01:59

Target

u237cgatAh2.exe
Size

5.6MB
MD5

0e2c1ee8e6bdb339094ec24026a01e20
SHA1

449972cb63e21bf25d03ad1e85cf87af97c75a2e
SHA256

ffe104f44b6a84074e2305fba55c1cb777446d1dace44c23eaf873536dcc542f
SHA512

c0a71a9d796802bdf7110c8f69ebdaeb9c968df69b41a8bc1ff52f3a4082f40df93085ec278863acc93763ca11114b4eac5278db136540be0bea67aa93c607c5
SSDEEP

98304:6s2vdJmvMwJ2liHiHeCJ+46C2m0B/YMh6FuLChc4n5Gc6jLq:6pdJK/46iHu4525Vh6FuLChRn5l6j2

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

u237cgatAh2.exe

pid process

2148 u237cgatAh2.exe
2148 u237cgatAh2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

u237cgatAh2.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

u237cgatAh2.execmd.exe

description	pid	process	target process
PID 2148 wrote to memory of 3064	2148	u237cgatAh2.exe	cmd.exe
PID 2148 wrote to memory of 3064	2148	u237cgatAh2.exe	cmd.exe
PID 2148 wrote to memory of 3064	2148	u237cgatAh2.exe	cmd.exe
PID 3064 wrote to memory of 2504	3064	cmd.exe	certutil.exe
PID 3064 wrote to memory of 2504	3064	cmd.exe	certutil.exe
PID 3064 wrote to memory of 2504	3064	cmd.exe	certutil.exe
PID 3064 wrote to memory of 2528	3064	cmd.exe	find.exe
PID 3064 wrote to memory of 2528	3064	cmd.exe	find.exe
PID 3064 wrote to memory of 2528	3064	cmd.exe	find.exe
PID 3064 wrote to memory of 2596	3064	cmd.exe	find.exe
PID 3064 wrote to memory of 2596	3064	cmd.exe	find.exe
PID 3064 wrote to memory of 2596	3064	cmd.exe	find.exe
PID 2148 wrote to memory of 2204	2148	u237cgatAh2.exe	cmd.exe
PID 2148 wrote to memory of 2204	2148	u237cgatAh2.exe	cmd.exe
PID 2148 wrote to memory of 2204	2148	u237cgatAh2.exe	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\u237cgatAh2.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\u237cgatAh2.exe" MD5
3⤵
PID:2504

memory/2148-2-0x0000000077620000-0x0000000077622000-memory.dmp

Filesize
8KB

Download
memory/2148-0-0x0000000077620000-0x0000000077622000-memory.dmp

Filesize
8KB

Download
memory/2148-4-0x0000000077620000-0x0000000077622000-memory.dmp

Filesize
8KB

Download
memory/2148-9-0x000000013FF60000-0x0000000140938000-memory.dmp

Filesize
9.8MB

Download
memory/2148-10-0x000000013FF60000-0x0000000140938000-memory.dmp

Filesize
9.8MB

Download
memory/2148-11-0x000000013FF60000-0x0000000140938000-memory.dmp

Filesize
9.8MB

Download