61363f656498d492cae671be8070e927d1e790b6008c369425320c3bc90c9178

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 19:35

Target

L8-Launch.exe
Size

16KB
MD5

ac70102a21b9ec0bd6f0d2042586a524
SHA1

bec66e57cba1477c2ea594670a3aea3af3f9286c
SHA256

61363f656498d492cae671be8070e927d1e790b6008c369425320c3bc90c9178
SHA512

353e3118211321e13b9e172ffb6915fd5fe8e4976e0844ec5301ddcd7d66121d34fe3ef86cea3e6e495716db3a81ddac12ce12189105bfc79fdb359ad11268aa
SSDEEP

192:LR7rJYCoZ3l+kfvJJREqKmFNnNfZfc6+DIf1D514VOpvHvJJ9Eql0fzLgS7wf:LRvJYC6U0vVrD0DEp5TvHvhkgow

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2932	z29AF.tmp

Loads dropped DLL 1 IoCs

pid	Process
2224	L8-Launch.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2932	2224	L8-Launch.exe	29
PID 2224 wrote to memory of 2932	2224	L8-Launch.exe	29
PID 2224 wrote to memory of 2932	2224	L8-Launch.exe	29
PID 2224 wrote to memory of 2932	2224	L8-Launch.exe	29
PID 2224 wrote to memory of 2932	2224	L8-Launch.exe	29
PID 2224 wrote to memory of 2932	2224	L8-Launch.exe	29
PID 2224 wrote to memory of 2932	2224	L8-Launch.exe	29

C:\Users\Admin\AppData\Local\Temp\L8-Launch.exe
"C:\Users\Admin\AppData\Local\Temp\L8-Launch.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\z29AF.tmp
  "C:\Users\Admin\AppData\Local\Temp\z29AF.tmp"
  2⤵
  - Executes dropped EXE
  PID:2932

\Users\Admin\AppData\Local\Temp\z29AF.tmp

Filesize
7KB

MD5
3d951066ec1a3d2b7c9570df48cd8d42

SHA1
cf07b026d0ad198661bba6e9cbc3c2e0bf3222a2

SHA256
daf8958d9410cc64123e8d56447a5d35d53c6063fe2db7e1df75f33ca79502d4

SHA512
ad2bb3732c8889ae365124e283f943c25dfd23287100be95bdb554ed37b6ab955db33864777995582df90aaf983fb2dc5f4299c3a51582d377b87fd87d428ebd

Download Submit