2d77b84b1672fbea169e5b66367588bb514a0d1c4245f3e7e353af3ead03e74f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:06

Target

2d77b84b1672fbea169e5b66367588bb514a0d1c4245f3e7e353af3ead03e74f.exe
Size

79KB
MD5

0d6c548c12c1298a44dd5826d57f2a92
SHA1

85873537777bdc2cfc082ef56de3390459948d4e
SHA256

2d77b84b1672fbea169e5b66367588bb514a0d1c4245f3e7e353af3ead03e74f
SHA512

cca262b171952756ae07fa3e70e07186f33a74467def44bc78d2bbdfbd9b7e28a25b086522fb86e2e75cd06fb11ee0173491a341f72e1e99cc1538bd5268c24e
SSDEEP

1536:zvKxifeJrDfME+2+OQA8AkqUhMb2nuy5wgIP0CSJ+5yCB8GMGlZ5G:zvGifgMSGdqU7uy5w9WMyCN5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

2344 [email protected]
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2976 cmd.exe
2976 cmd.exe

pid	process
2344	[email protected]

pid	process
2976	cmd.exe
2976	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2d77b84b1672fbea169e5b66367588bb514a0d1c4245f3e7e353af3ead03e74f.execmd.exe

description	pid	process	target process
PID 2868 wrote to memory of 2976	2868	2d77b84b1672fbea169e5b66367588bb514a0d1c4245f3e7e353af3ead03e74f.exe	cmd.exe
PID 2868 wrote to memory of 2976	2868	2d77b84b1672fbea169e5b66367588bb514a0d1c4245f3e7e353af3ead03e74f.exe	cmd.exe
PID 2868 wrote to memory of 2976	2868	2d77b84b1672fbea169e5b66367588bb514a0d1c4245f3e7e353af3ead03e74f.exe	cmd.exe
PID 2868 wrote to memory of 2976	2868	2d77b84b1672fbea169e5b66367588bb514a0d1c4245f3e7e353af3ead03e74f.exe	cmd.exe
PID 2976 wrote to memory of 2344	2976	cmd.exe	[email protected]
PID 2976 wrote to memory of 2344	2976	cmd.exe	[email protected]
PID 2976 wrote to memory of 2344	2976	cmd.exe	[email protected]
PID 2976 wrote to memory of 2344	2976	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\2d77b84b1672fbea169e5b66367588bb514a0d1c4245f3e7e353af3ead03e74f.exe
"C:\Users\Admin\AppData\Local\Temp\2d77b84b1672fbea169e5b66367588bb514a0d1c4245f3e7e353af3ead03e74f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2344

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
1c4ec78b6a38b6a3fb3b4da4197dc1f3

SHA1
4693c510a0a7ca0d8085ef76f623327d2624fb0e

SHA256
0e0f831b95b08a4025aae01d48b043d205ac06e9bd73ca02d07493c2487d9ffa

SHA512
493f180c26ed77c37e8550a95037f22f603bfec3cdb0a49caf258322f9b8e19a96560aed6918ba6408f0fcf71c72565bf7211f83e1328847cec5d3b0b2d5752d

Download Submit
memory/2344-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2868-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download