ffe104f44b6a84074e2305fba55c1cb777446d1dace44c23eaf873536dcc542f

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 05:43

Target

u237cgatAh2.exe
Size

5.6MB
MD5

0e2c1ee8e6bdb339094ec24026a01e20
SHA1

449972cb63e21bf25d03ad1e85cf87af97c75a2e
SHA256

ffe104f44b6a84074e2305fba55c1cb777446d1dace44c23eaf873536dcc542f
SHA512

c0a71a9d796802bdf7110c8f69ebdaeb9c968df69b41a8bc1ff52f3a4082f40df93085ec278863acc93763ca11114b4eac5278db136540be0bea67aa93c607c5
SSDEEP

98304:6s2vdJmvMwJ2liHiHeCJ+46C2m0B/YMh6FuLChc4n5Gc6jLq:6pdJK/46iHu4525Vh6FuLChRn5l6j2

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1976	u237cgatAh2.exe
1976	u237cgatAh2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2584	1976	u237cgatAh2.exe	29
PID 1976 wrote to memory of 2584	1976	u237cgatAh2.exe	29
PID 1976 wrote to memory of 2584	1976	u237cgatAh2.exe	29
PID 2584 wrote to memory of 2572	2584	cmd.exe	30
PID 2584 wrote to memory of 2572	2584	cmd.exe	30
PID 2584 wrote to memory of 2572	2584	cmd.exe	30
PID 2584 wrote to memory of 1248	2584	cmd.exe	31
PID 2584 wrote to memory of 1248	2584	cmd.exe	31
PID 2584 wrote to memory of 1248	2584	cmd.exe	31
PID 2584 wrote to memory of 2712	2584	cmd.exe	32
PID 2584 wrote to memory of 2712	2584	cmd.exe	32
PID 2584 wrote to memory of 2712	2584	cmd.exe	32
PID 1976 wrote to memory of 2576	1976	u237cgatAh2.exe	33
PID 1976 wrote to memory of 2576	1976	u237cgatAh2.exe	33
PID 1976 wrote to memory of 2576	1976	u237cgatAh2.exe	33

C:\Users\Admin\AppData\Local\Temp\u237cgatAh2.exe
"C:\Users\Admin\AppData\Local\Temp\u237cgatAh2.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\u237cgatAh2.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\u237cgatAh2.exe" MD5
    3⤵
    PID:2572
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1248
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2576

memory/1976-0-0x0000000077A90000-0x0000000077A92000-memory.dmp

Filesize
8KB

Download
memory/1976-2-0x0000000077A90000-0x0000000077A92000-memory.dmp

Filesize
8KB

Download
memory/1976-4-0x0000000077A90000-0x0000000077A92000-memory.dmp

Filesize
8KB

Download
memory/1976-7-0x000000013F208000-0x000000013F5A9000-memory.dmp

Filesize
3.6MB

Download
memory/1976-10-0x000000013F170000-0x000000013FB48000-memory.dmp

Filesize
9.8MB

Download
memory/1976-11-0x000000013F170000-0x000000013FB48000-memory.dmp

Filesize
9.8MB

Download