7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 23:26

Target

7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe
Size

79KB
MD5

0dbbdfb374a6b5863ac3dc6dd6e09f12
SHA1

b93cc5c0b6361c96fa4df88823bf37f1272d65c5
SHA256

7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5
SHA512

d4184d79bba98609736769f7600aa58ba681b0fec817a0808cf2ab75c3beaaec9c814d14677381164e773b56fc8ae129e17d1f10cffc8eb3475daa2270ca2edf
SSDEEP

1536:zvANfA7voIfaFOQA8AkqUhMb2nuy5wgIP0CSJ+5ydB8GMGlZ5G:zvANfvi9GdqU7uy5w9WMydN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1628	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2096	cmd.exe
2096	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2096	1072	7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe	29
PID 1072 wrote to memory of 2096	1072	7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe	29
PID 1072 wrote to memory of 2096	1072	7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe	29
PID 1072 wrote to memory of 2096	1072	7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe	29
PID 2096 wrote to memory of 1628	2096	cmd.exe	30
PID 2096 wrote to memory of 1628	2096	cmd.exe	30
PID 2096 wrote to memory of 1628	2096	cmd.exe	30
PID 2096 wrote to memory of 1628	2096	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe
"C:\Users\Admin\AppData\Local\Temp\7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1628

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
871c5fb9115e010ff5606b07b60340fb

SHA1
9aa6432a4ba263430491b799e2a03daf9e085f8d

SHA256
3b53b119e19e7c21082328a342b9ec1514efbe797bf602a01e7975cda8a36017

SHA512
f02ba3ddda3be2f2338852cc3981bad9a24081d8aac73a753d3bc1d10ed0486d6fa27a69d9ed36d041831a3946058bbac116cd280e88630b60d7432c842f6cb0

Download Submit
memory/1072-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1628-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download