cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 04:27

Target
cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe
Size 29KB
Sample240612-e26vsa1bqk
SHA256 cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f
MD5 a2b710d6fdee3eec4b1bb929e9afb1aa
SHA1 f98eb3944379205ad9820384e8b0953f549cc248
SHA512 59cc25cf51c9f7abe9acd68d6ac5c10f8864aa206204e760792d73435cf7d2cc5a4cb1161cb8c7d66a274940bf791f06334fae41437fb320d40eb4c17f59d9dd
SSDEEP 384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGF45:v/qSamrxDmqoKM4Z0iwtwc45
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3004	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3008	2024061204.exe

Loads dropped DLL 2 IoCs

pid	Process
1224	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe
1224	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1224	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe
3008	2024061204.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 3008	1224	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	28
PID 1224 wrote to memory of 3008	1224	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	28
PID 1224 wrote to memory of 3008	1224	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	28
PID 1224 wrote to memory of 3008	1224	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	28
PID 1224 wrote to memory of 3004	1224	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	29
PID 1224 wrote to memory of 3004	1224	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	29
PID 1224 wrote to memory of 3004	1224	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	29
PID 1224 wrote to memory of 3004	1224	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	29

C:\Users\Admin\AppData\Local\Temp\cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe
"C:\Users\Admin\AppData\Local\Temp\cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\2024061204.exe
  C:\Users\Admin\AppData\Local\Temp\2024061204.exe down
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  - Deletes itself
  PID:3004

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 267B
SHA256 284e7c6a1264bb60eb1bc3a71e5d0c96a3dc04385a30985caccd720e1eb589a3
MD5 7f6ef99b64f36d1f04e21c9d30447e9d
SHA1 eb3592598746c909de43a1723d5e3d96f78c8bf6
SHA512 bf470fa2deb6a0a198c63e9b27ca59806d3e79eb17842af0d95e723cd4ab8d2e8ae8d4364b9c73b379fcc69bb9fe2a8004f730f94b25c425e62f204073760264
MD5 SHA1 SHA512

Submit Download

2024061204.exe

Path \Users\Admin\AppData\Local\Temp\2024061204.exe
Size 29KB
SHA256 1bab010ee4d055c72f0489c1fb9e5b50be316b322cba5c4867199d5defd4c32e
MD5 9629bdd8e494bd1672f76f44b89fec87
SHA1 6a87f30fd9ba5d9a6979a1c484d135097b546127
SHA512 85a1bbfc67f91c7eab26d71a5bc71e8179bdc25c0d6f1ac4eec5308bff7f09eb8c493f048889ae272cb40eb69865cc53a1dd66fad314135bed542882165c029c
SSDEEP 384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGF4l:v/qSamrxDmqoKM4Z0iwtwc4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3008-24-0x0000000000400000-0x0000000000408000-memory.dmp

Download