a6ab8d5223cf97abcf6de299231f7f9693d30ae20e928295e8d47beb8f733ae1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:26

Target

a6ab8d5223cf97abcf6de299231f7f9693d30ae20e928295e8d47beb8f733ae1.exe
Size

73KB
MD5

1772a0a3d1a5916ff65deafa6cbfa1ad
SHA1

14e9eff432c303204bb23ddd58217a9542eedc65
SHA256

a6ab8d5223cf97abcf6de299231f7f9693d30ae20e928295e8d47beb8f733ae1
SHA512

d0a48f24568da9d05e5b79702b0c3517a8be950df4a28fe6346e5949822b25437a0eec4bc04f9505db461b1086399c2b520daa84c9ee8019b7f03d233fadcdac
SSDEEP

1536:hbcNbiYUY1/ox6e4FK5QPqfhVWbdsmA+RjPFLC+e5hST0ZGUGf2g:hYNmY3/26NFNPqfcxA+HFshSTOg

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

764 [email protected]
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

3056 cmd.exe
3056 cmd.exe

pid	process
764	[email protected]

pid	process
3056	cmd.exe
3056	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

a6ab8d5223cf97abcf6de299231f7f9693d30ae20e928295e8d47beb8f733ae1.execmd.exe[email protected]

description	pid	process	target process
PID 2952 wrote to memory of 3056	2952	a6ab8d5223cf97abcf6de299231f7f9693d30ae20e928295e8d47beb8f733ae1.exe	cmd.exe
PID 2952 wrote to memory of 3056	2952	a6ab8d5223cf97abcf6de299231f7f9693d30ae20e928295e8d47beb8f733ae1.exe	cmd.exe
PID 2952 wrote to memory of 3056	2952	a6ab8d5223cf97abcf6de299231f7f9693d30ae20e928295e8d47beb8f733ae1.exe	cmd.exe
PID 2952 wrote to memory of 3056	2952	a6ab8d5223cf97abcf6de299231f7f9693d30ae20e928295e8d47beb8f733ae1.exe	cmd.exe
PID 3056 wrote to memory of 764	3056	cmd.exe	[email protected]
PID 3056 wrote to memory of 764	3056	cmd.exe	[email protected]
PID 3056 wrote to memory of 764	3056	cmd.exe	[email protected]
PID 3056 wrote to memory of 764	3056	cmd.exe	[email protected]
PID 764 wrote to memory of 2760	764	[email protected]	cmd.exe
PID 764 wrote to memory of 2760	764	[email protected]	cmd.exe
PID 764 wrote to memory of 2760	764	[email protected]	cmd.exe
PID 764 wrote to memory of 2760	764	[email protected]	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a6ab8d5223cf97abcf6de299231f7f9693d30ae20e928295e8d47beb8f733ae1.exe
"C:\Users\Admin\AppData\Local\Temp\a6ab8d5223cf97abcf6de299231f7f9693d30ae20e928295e8d47beb8f733ae1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
e04891937963437a25b9b6e0ce03c6d7

SHA1
a84139a2ae5afdefcd81b6fc37432e186c8833a8

SHA256
5e2e90d5d63e6757ec56e8345bd106fff4e53f828521d130c8e987805f85bfd4

SHA512
9d78319a8f006990ac8b05759d5711326f40e563039a7d4083a28efcd33371b00ee7664a6e5359c9422b021a267723b5335d62237448edf7dee5f842b73bc260

Download Submit
memory/764-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2952-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download