e7e5671650d2d40fc31719edaae7dad63d6db32dc6464f1a039c010e07e9fc16

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 05:28

Target

e7e5671650d2d40fc31719edaae7dad63d6db32dc6464f1a039c010e07e9fc16.exe
Size

79KB
MD5

0fa3215949335e877eb76af4ff239b37
SHA1

14b98db94e65de204d6dcb99a15992856f86e8ba
SHA256

e7e5671650d2d40fc31719edaae7dad63d6db32dc6464f1a039c010e07e9fc16
SHA512

d313ab96d4a6dfb3c9ba38fc1e12f107fa1306f22c4f4fc8c68c07b8ee9130f1090d353f1ae1c252cdc6913e672f5dabc6009e691e3b61b9e6b610b50cad0600
SSDEEP

1536:zv1FbW6fkOQA8AkqUhMb2nuy5wgIP0CSJ+5y0B8GMGlZ5G:zvrW6fBGdqU7uy5w9WMy0N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2040	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2300	cmd.exe
2300	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2300	2004	e7e5671650d2d40fc31719edaae7dad63d6db32dc6464f1a039c010e07e9fc16.exe	29
PID 2004 wrote to memory of 2300	2004	e7e5671650d2d40fc31719edaae7dad63d6db32dc6464f1a039c010e07e9fc16.exe	29
PID 2004 wrote to memory of 2300	2004	e7e5671650d2d40fc31719edaae7dad63d6db32dc6464f1a039c010e07e9fc16.exe	29
PID 2004 wrote to memory of 2300	2004	e7e5671650d2d40fc31719edaae7dad63d6db32dc6464f1a039c010e07e9fc16.exe	29
PID 2300 wrote to memory of 2040	2300	cmd.exe	30
PID 2300 wrote to memory of 2040	2300	cmd.exe	30
PID 2300 wrote to memory of 2040	2300	cmd.exe	30
PID 2300 wrote to memory of 2040	2300	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\e7e5671650d2d40fc31719edaae7dad63d6db32dc6464f1a039c010e07e9fc16.exe
"C:\Users\Admin\AppData\Local\Temp\e7e5671650d2d40fc31719edaae7dad63d6db32dc6464f1a039c010e07e9fc16.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2040

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
05285fff1bf7921a22e85bc9b545a240

SHA1
164dd10b816bd47e219332f07def00c62691f89a

SHA256
c4304a67cff3f6e4a4b119aa23b92d51608fb0969c8ce09dbb2a43554a1e7419

SHA512
ea5704ed03ff5f593875b33713d2af4cd1db9966296610203d3fa99633c1e7b29c1569d75f3a12f813872c1b4248233505b3a6b6f446e25f2795d2a734813005

Download Submit
memory/2004-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2040-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download