b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:18

Target

b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe
Size

79KB
MD5

21f2ae59f2bb86ea9cb01797d1deb3d9
SHA1

db4f9a2346338f219aabe43ed733b0c9dabde527
SHA256

b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236
SHA512

4a9e8eb158257ee94fbcb6a90a65e1d6772a8cc59af76ccabc3bd165825f5ac59dd29b8e38929ec647c08009a293e4b526e2403e832bb4e05c9d0775a203fec8
SSDEEP

1536:zvvSjrPgawlHWzMLP0OOQA8AkqUhMb2nuy5wgIP0CSJ+5y2B8GMGlZ5G:zvvSj8aKHWgLP0bGdqU7uy5w9WMy2N5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

2972 [email protected]
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

280 cmd.exe
280 cmd.exe

pid	process
2972	[email protected]

pid	process
280	cmd.exe
280	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.execmd.exe

description	pid	process	target process
PID 2984 wrote to memory of 280	2984	b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe	cmd.exe
PID 2984 wrote to memory of 280	2984	b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe	cmd.exe
PID 2984 wrote to memory of 280	2984	b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe	cmd.exe
PID 2984 wrote to memory of 280	2984	b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe	cmd.exe
PID 280 wrote to memory of 2972	280	cmd.exe	[email protected]
PID 280 wrote to memory of 2972	280	cmd.exe	[email protected]
PID 280 wrote to memory of 2972	280	cmd.exe	[email protected]
PID 280 wrote to memory of 2972	280	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe
"C:\Users\Admin\AppData\Local\Temp\b8ed5072600fefe39286837cfbcdecca294f21074045b53e759410973231c236.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Users\Admin\AppData\Local\Temp\[email protected]
[email protected]
3⤵
- Executes dropped EXE
PID:2972

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
afb755a252ada2516e53a4279544cfe2

SHA1
366ebf4c1c609e0f6bd25e62f8417c48f13fd826

SHA256
250957582285c494a4cfba8e856619a7814bd966352ff196339aeb2e4785c84b

SHA512
18476be1b3d45620d7822e2301e99322c38483f88abe0f86adbdb0cef351e67d0ff79e6a444c19266124ace21531ca589e15c37f5f368a6a0e6faac84308929a

Download Submit
memory/2972-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2984-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download