561106cf718d3d2758ff1b862adac8da2dba5538fda247d82bdec49da46d3738

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:20

Target

561106cf718d3d2758ff1b862adac8da2dba5538fda247d82bdec49da46d3738.exe
Size

44KB
MD5

2749afb208f2054b0e6e7afd15551140
SHA1

c75ef52a78a59b2e43e4c08853351ceae0d8d5ef
SHA256

561106cf718d3d2758ff1b862adac8da2dba5538fda247d82bdec49da46d3738
SHA512

3858fd54cfe5feb08f11d6dd78834d6605c4bb505dd8b6ee6317cbf2207a48fb0eacb36e33189009681420b24c65474d952c9b1089814d8262545744e86518e0
SSDEEP

768:GyGdGZFGkI4W35hE49sUFFzBeGYUjXMa0GbiOU7pg3wr064P34KqHF:GyGd+M35hE49sUFFzBAUOPyG

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

foodwic.exe

pid process

3204 foodwic.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

24 icanhazip.com

pid	process
3204	foodwic.exe

flow	ioc
24	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

561106cf718d3d2758ff1b862adac8da2dba5538fda247d82bdec49da46d3738.exe

description	pid	process	target process
PID 1668 wrote to memory of 3204	1668	561106cf718d3d2758ff1b862adac8da2dba5538fda247d82bdec49da46d3738.exe	foodwic.exe
PID 1668 wrote to memory of 3204	1668	561106cf718d3d2758ff1b862adac8da2dba5538fda247d82bdec49da46d3738.exe	foodwic.exe
PID 1668 wrote to memory of 3204	1668	561106cf718d3d2758ff1b862adac8da2dba5538fda247d82bdec49da46d3738.exe	foodwic.exe

C:\Users\Admin\AppData\Local\Temp\561106cf718d3d2758ff1b862adac8da2dba5538fda247d82bdec49da46d3738.exe
"C:\Users\Admin\AppData\Local\Temp\561106cf718d3d2758ff1b862adac8da2dba5538fda247d82bdec49da46d3738.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\foodwic.exe
C:\Users\Admin\AppData\Local\Temp\foodwic.exe
2⤵
- Executes dropped EXE
PID:3204

C:\Users\Admin\AppData\Local\Temp\foodwic.exe
Filesize
44KB

MD5
ed11c60543b2609efe9efd62fd53af5d

SHA1
ca5e0f267d8cbf5c8b1e359a56ba9f22748e6932

SHA256
225cce7a26ef71f8b8fcd2eb23a999727441b5a072687b6e5fd4e7dd0ca8d3a0

SHA512
6cc4481feceb9894f2882b67422e2ccb7fbd0bd2a023761f882c8540c42fa0189d0bb828821c3c5b83681ef460fcf36afe35ddd9a15037bd4b8edea5f4248d11

Download Submit
memory/1668-0-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/1668-2-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/3204-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3204-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download