5c4fbd4a1ff610383bad2efa81d864e26e2118ef371ea1b8126f90b1282787cb

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:09

Target

5c4fbd4a1ff610383bad2efa81d864e26e2118ef371ea1b8126f90b1282787cb.exe
Size

79KB
MD5

052fc9336ac48797212e94548efcc4b9
SHA1

3df4d9e9ab910a595969e3d909917137cd46b949
SHA256

5c4fbd4a1ff610383bad2efa81d864e26e2118ef371ea1b8126f90b1282787cb
SHA512

6ffd3d5b4407050a5a6ff9709c72ac573a85d66f1c6c4ab76af00c7913a617c9be6820e39fb2e08baf680170922d81a56b3eb4d456b4333ccc37fec97aca933c
SSDEEP

1536:zvQg6AC/A7Cp0LlOQA8AkqUhMb2nuy5wgIP0CSJ+5y9B8GMGlZ5G:zvvQA+hGdqU7uy5w9WMy9N5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

2480 [email protected]
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2104 cmd.exe
2104 cmd.exe

pid	process
2480	[email protected]

pid	process
2104	cmd.exe
2104	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5c4fbd4a1ff610383bad2efa81d864e26e2118ef371ea1b8126f90b1282787cb.execmd.exe

description	pid	process	target process
PID 1908 wrote to memory of 2104	1908	5c4fbd4a1ff610383bad2efa81d864e26e2118ef371ea1b8126f90b1282787cb.exe	cmd.exe
PID 1908 wrote to memory of 2104	1908	5c4fbd4a1ff610383bad2efa81d864e26e2118ef371ea1b8126f90b1282787cb.exe	cmd.exe
PID 1908 wrote to memory of 2104	1908	5c4fbd4a1ff610383bad2efa81d864e26e2118ef371ea1b8126f90b1282787cb.exe	cmd.exe
PID 1908 wrote to memory of 2104	1908	5c4fbd4a1ff610383bad2efa81d864e26e2118ef371ea1b8126f90b1282787cb.exe	cmd.exe
PID 2104 wrote to memory of 2480	2104	cmd.exe	[email protected]
PID 2104 wrote to memory of 2480	2104	cmd.exe	[email protected]
PID 2104 wrote to memory of 2480	2104	cmd.exe	[email protected]
PID 2104 wrote to memory of 2480	2104	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\5c4fbd4a1ff610383bad2efa81d864e26e2118ef371ea1b8126f90b1282787cb.exe
"C:\Users\Admin\AppData\Local\Temp\5c4fbd4a1ff610383bad2efa81d864e26e2118ef371ea1b8126f90b1282787cb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2480

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
cc10b5f354f53f3383eb2360504473b0

SHA1
6da89f8fa969be23ee078b68e6eb3393bdec36df

SHA256
9697712fcc6e90cc46e9c6a5debd1cfabe8b6d7ab5facf1320d4bdbd2a5adeb6

SHA512
ebe55857356a99a17f9860a99e3e4e74764d05aaf774cf77e6bdd6c965f33942b844d6529fc98ba5d95cc90b87ae39ee9ecef0a2116658bb0d3877534b57c97a

Download Submit
memory/1908-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2480-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download