4d7c8cf5f7260151e36ea0fa3041ef9866f77c27d86e340c072572e01549928c

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 15:29

Target

Project1.exe
Size

562KB
MD5

a89b46bfee09a7eab29e66b76b958edc
SHA1

028bab7475e2ae08118faaaed324d167c1144f79
SHA256

4d7c8cf5f7260151e36ea0fa3041ef9866f77c27d86e340c072572e01549928c
SHA512

43c45705eb11c57a440c8976dc27c14394df6ffa10764d443740bb52365e04c1809cd466dbdd0bf8d57434da6d979c7752beb6078ee04fdf1547df6ff2797429
SSDEEP

12288:3SSPZUfmJ6jEgMk+XA9h0uZZWYzNgnoAt6QUpEU:3ZZUfmJ8Ex89h009zq7tQ6U

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Speech\kdmapper.exe	Project1.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1788	2792	Project1.exe	29
PID 2792 wrote to memory of 1788	2792	Project1.exe	29
PID 2792 wrote to memory of 1788	2792	Project1.exe	29
PID 2792 wrote to memory of 1316	2792	Project1.exe	30
PID 2792 wrote to memory of 1316	2792	Project1.exe	30
PID 2792 wrote to memory of 1316	2792	Project1.exe	30
PID 1788 wrote to memory of 1284	1788	cmd.exe	31
PID 1788 wrote to memory of 1284	1788	cmd.exe	31
PID 1788 wrote to memory of 1284	1788	cmd.exe	31
PID 1788 wrote to memory of 2072	1788	cmd.exe	32
PID 1788 wrote to memory of 2072	1788	cmd.exe	32
PID 1788 wrote to memory of 2072	1788	cmd.exe	32
PID 1788 wrote to memory of 2916	1788	cmd.exe	33
PID 1788 wrote to memory of 2916	1788	cmd.exe	33
PID 1788 wrote to memory of 2916	1788	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\Project1.exe
"C:\Users\Admin\AppData\Local\Temp\Project1.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Project1.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Project1.exe" MD5
    3⤵
    PID:1284
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2072
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2792 -s 220
  2⤵
  PID:1316