334ff28fe4b1d30e50c6ca719aa2a6ac44528fcffe4c34bfa859dc6638a03e12

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 21:00

Target

334ff28fe4b1d30e50c6ca719aa2a6ac44528fcffe4c34bfa859dc6638a03e12.exe
Size

79KB
MD5

7b8f4000e875d7e461fcecc2d288b522
SHA1

1951f469973f8bffea94b47f2807d0bd42031e04
SHA256

334ff28fe4b1d30e50c6ca719aa2a6ac44528fcffe4c34bfa859dc6638a03e12
SHA512

6f0ac156ab8b27ee2711eebc6eb25188a835466563075716e090689e0e0ce9f07ff4fa713ef54f05390ff1cca59e7e3fdcb6d1229c68b365cbbbc4377f8ef4ed
SSDEEP

1536:zvALFiJ37Oz0Uw++nOQA8AkqUhMb2nuy5wgIP0CSJ+5yoB8GMGlZ5G:zvQcOGdqU7uy5w9WMyoN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2984	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2156	cmd.exe
2156	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2156	1180	334ff28fe4b1d30e50c6ca719aa2a6ac44528fcffe4c34bfa859dc6638a03e12.exe	29
PID 1180 wrote to memory of 2156	1180	334ff28fe4b1d30e50c6ca719aa2a6ac44528fcffe4c34bfa859dc6638a03e12.exe	29
PID 1180 wrote to memory of 2156	1180	334ff28fe4b1d30e50c6ca719aa2a6ac44528fcffe4c34bfa859dc6638a03e12.exe	29
PID 1180 wrote to memory of 2156	1180	334ff28fe4b1d30e50c6ca719aa2a6ac44528fcffe4c34bfa859dc6638a03e12.exe	29
PID 2156 wrote to memory of 2984	2156	cmd.exe	30
PID 2156 wrote to memory of 2984	2156	cmd.exe	30
PID 2156 wrote to memory of 2984	2156	cmd.exe	30
PID 2156 wrote to memory of 2984	2156	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\334ff28fe4b1d30e50c6ca719aa2a6ac44528fcffe4c34bfa859dc6638a03e12.exe
"C:\Users\Admin\AppData\Local\Temp\334ff28fe4b1d30e50c6ca719aa2a6ac44528fcffe4c34bfa859dc6638a03e12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2984

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
9b438d34804ff918afa4d216027a80db

SHA1
0c2066b39f4ffda9b5c015cfeaa808f9d3d04d0c

SHA256
a2adfd2f4fea70447f14a8b772377e327c02d99d42d1c2428e42f7d10dce84b5

SHA512
9cd449bfc1781a1b5bb995558b8b10b6ae354e068d570bb49494347aa97d72ba915a01f17ebdcc81b2831c8d536ad5fec75c03aceae3d437d92f7c6a7a47f407

Download Submit
memory/1180-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2984-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download