70092856c9eeb38f6d7c031f0300630ec27d3fbd9f751ab0d1246e35f86aba80

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 09:34

Target

loader.exe
Size

1.6MB
MD5

9c3be7203ba00ad3a4aa5c060d92e032
SHA1

73889da9d3516234b199902efdc996e830d7ed12
SHA256

70092856c9eeb38f6d7c031f0300630ec27d3fbd9f751ab0d1246e35f86aba80
SHA512

edb44fd610fddfd469242bf43c0c79997aac07ed1bf7d7263fd0ba49d923bde7b36254e89cd98039df8a9d6ad9914599eaaed22e4f29a8939638a58c5ff140ad
SSDEEP

49152:x2+bFGaqjaqjyX3KLsRnkFyd+PfvSTgr8z:jk1yX3VRE

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2148	1848	loader.exe	29
PID 1848 wrote to memory of 2148	1848	loader.exe	29
PID 1848 wrote to memory of 2148	1848	loader.exe	29
PID 2148 wrote to memory of 1152	2148	cmd.exe	30
PID 2148 wrote to memory of 1152	2148	cmd.exe	30
PID 2148 wrote to memory of 1152	2148	cmd.exe	30
PID 2148 wrote to memory of 2128	2148	cmd.exe	31
PID 2148 wrote to memory of 2128	2148	cmd.exe	31
PID 2148 wrote to memory of 2128	2148	cmd.exe	31
PID 2148 wrote to memory of 1276	2148	cmd.exe	32
PID 2148 wrote to memory of 1276	2148	cmd.exe	32
PID 2148 wrote to memory of 1276	2148	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\loader.exe" MD5
    3⤵
    PID:1152
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2128
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1276