b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:06

Target

b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe
Size

384KB
MD5

0fbc725f6582e6b95ca997f6352d90bc
SHA1

af348ab699bda2ddcde8c83bc96a2d8e2ad2d71d
SHA256

b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20
SHA512

5f78d1bb8fb0f5b97d6c492fe09e8fc7e2567d57e7edd962b832b9aa3b1a79d2190206c7e95d36460684c3c5225b4e2acdc8d6cc7d83dc919351df1367dc2caf
SSDEEP

6144:KvZ1R8jn8t/hnw11P3RDOrHOKTVsOLu9/6V40saiigCD4H2hz8QZA:km8fns1vRarHnpsOLu9/6VQ5zCD4V3

Score

7^/10

Deletes itself 1 IoCs

Processes:

b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

pid process

2420 b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe
Executes dropped EXE 1 IoCs

Processes:

b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

pid process

2420 b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe
Loads dropped DLL 1 IoCs

Processes:

b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

pid process

2124 b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

pid process

2124 b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

pid process

2420 b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

pid	process
2420	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

pid	process
2420	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

pid	process
2124	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

pid	process
2124	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

pid	process
2420	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

description	pid	process	target process
PID 2124 wrote to memory of 2420	2124	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe
PID 2124 wrote to memory of 2420	2124	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe
PID 2124 wrote to memory of 2420	2124	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe
PID 2124 wrote to memory of 2420	2124	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe	b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

\Users\Admin\AppData\Local\Temp\b3d8989b5a0775db17c2c30e0f6262beccbf3659a916a67aaf60bc5b1d2b6f20.exe

Filesize
384KB

MD5
6908a50a5beb232d08949c021f57b576

SHA1
2c6383d9f5f05388d4c1cc9fa658eb408eb9a9b2

SHA256
3e48a0a8a282f357c5d8deb1fef69615821f6c90101aa7a1d11d1b322dabd0ef

SHA512
da375c94d80e3884db89d165f55e919bbadf18d55ee9193f721af2665b9da8e9a1970c9cceed0505d6494778e8dc5d28c3a4416c294488159e5bc033346ce837

Download Submit
memory/2124-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2124-10-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2420-9-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2420-11-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2420-16-0x00000000001B0000-0x00000000001F1000-memory.dmp

Filesize
260KB

Download