c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 03:02

Target

c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe
Size

320KB
MD5

2366207c90efdb4e06c27d1b0be6b0fa
SHA1

23b0d1c16bc54d813416e2fa076fe8da9308d194
SHA256

c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7
SHA512

875b32bbef3045cec60e872cb820b4e7bdfaeb070f5fdad9a22457cf557edfb6e028245a80e793629ce14f6cdaca631fab561ba395ca7d66dc597fff87437712
SSDEEP

6144:5RMvewKVx8QS4U7zBE2wZliNIDEqZK0W7cyqCxSngmMBqfycuPbUl0i5w:5RoeNKQ07AZMwEqZQ0npM4dl0b

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2960	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe

Executes dropped EXE 1 IoCs

pid	Process
2960	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe

Loads dropped DLL 1 IoCs

pid	Process
2268	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2960	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2268	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2960	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2960	2268	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe	28
PID 2268 wrote to memory of 2960	2268	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe	28
PID 2268 wrote to memory of 2960	2268	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe	28
PID 2268 wrote to memory of 2960	2268	c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe	28

\Users\Admin\AppData\Local\Temp\c79f3f55a7aea6f451b0081e2fabbdb2b9e7ff85a411303c9bf524c8b9b409d7.exe

Filesize
320KB

MD5
774b3b4876118733abe198c2770fd8fe

SHA1
e1b686b60669d0448a57356468f1a88edd5fa93a

SHA256
0ead56d5ad3b79b171559fe39e2f9341e26a976a9fb5d6c5444de03bea8f5162

SHA512
4186d31e09d652fcba5817beb79ae8ef9937a54efb6df1c43ff95442409c17fb3664863b4b109d414630406178e44f9390d50c5b754f95ff9a98056e4b905723

Download Submit
memory/2268-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2268-5-0x0000000000130000-0x0000000000168000-memory.dmp

Filesize
224KB

Download
memory/2268-11-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2960-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2960-13-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2960-18-0x00000000000C0000-0x00000000000F8000-memory.dmp

Filesize
224KB

Download