dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 04:15

Target

dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe
Size

36KB
MD5

48eac09ab83073fd9d5c8f7ead19ab95
SHA1

cbcaab353b8e84fed01b28c8fbdfb6e2132f8feb
SHA256

dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae
SHA512

44b3e3ffee59f1666d5f3d579dc1dab25bb29446f70c9ac5f8a77c6b5b6b7aa60a2eac23fc7c0b27107917a0fe2f98bcbbbe0cc106aa913a2e8467871370e15e
SSDEEP

384:cKUDthWY/ANpYL3QVvSwBRcDgYCNXGQaI/I51Ee2m3wJp6R3IYsBl3VRBJ:SWTNyMhhvcgNWQBG1Ee/Mg6dTBJ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2724	bxqyy.exe

Loads dropped DLL 1 IoCs

pid	Process
2172	dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2724	2172	dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe	28
PID 2172 wrote to memory of 2724	2172	dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe	28
PID 2172 wrote to memory of 2724	2172	dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe	28
PID 2172 wrote to memory of 2724	2172	dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe	28

C:\Users\Admin\AppData\Local\Temp\dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe
"C:\Users\Admin\AppData\Local\Temp\dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\bxqyy.exe
  C:\Users\Admin\AppData\Local\Temp\bxqyy.exe
  2⤵
  - Executes dropped EXE
  PID:2724

\Users\Admin\AppData\Local\Temp\bxqyy.exe

Filesize
36KB

MD5
cb85e5614c73d87c70b4b51aa6bc8384

SHA1
4699d9dbbd8769b4eae49f71c713697b2bb01a5e

SHA256
00a62bc24a621500b6d363da8ac081587249238bf59147ef5e81476466ab62f7

SHA512
88cb0961fb19d1065854f2c6f176f9382d4939b6068c1da9b5f49a25d42869cd09fa90fadf5f03da31fd74eb7eaba43c80ec5113e316626a7de07df62d853821

Download Submit
memory/2172-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2724-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download