7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 23:05

Target

7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe
Size

29KB
MD5

ae6b03bdbe142dfc9e337415b4a0fed7
SHA1

50a1c6a4a11fed85dc1441320e52881b757c2b22
SHA256

7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663
SHA512

50aeb2acf43b3ed470ae39b7d8c5b68fd524489355a56e71e91d16905e8e41e2ddae35e3f20922e9fe5a757e9a6e10b1f6eef93c5736b4a3226fa4889005ba00
SSDEEP

384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGXLs:v/qSamrxDmqoKM4Z0iwtwALs

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2620	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
868	2024061423.exe

Loads dropped DLL 2 IoCs

pid	Process
1800	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe
1800	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1800	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe
868	2024061423.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 868	1800	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	28
PID 1800 wrote to memory of 868	1800	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	28
PID 1800 wrote to memory of 868	1800	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	28
PID 1800 wrote to memory of 868	1800	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	28
PID 1800 wrote to memory of 2620	1800	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	29
PID 1800 wrote to memory of 2620	1800	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	29
PID 1800 wrote to memory of 2620	1800	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	29
PID 1800 wrote to memory of 2620	1800	7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe	29

C:\Users\Admin\AppData\Local\Temp\7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe
"C:\Users\Admin\AppData\Local\Temp\7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\2024061423.exe
  C:\Users\Admin\AppData\Local\Temp\2024061423.exe down
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  - Deletes itself
  PID:2620

C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
267B

MD5
669a3ff7732aa82dcac8feb22e100747

SHA1
325a54698630a8e3801d7667658144412a034f4c

SHA256
78d4566ca95d3a0d89a2b619a6561f4b3bb25463c045d32a05fce9150dba9a67

SHA512
ca45d694ec59ca46cbf7532f54841edc5aae788cf297cf26ae3baf4c70c986b1417028615db817979097a1b011869374cd64e1ce669b131a7850771de5b97db4

Download Submit
\Users\Admin\AppData\Local\Temp\2024061423.exe

Filesize
29KB

MD5
d56557e683afdf0a00c007bfab15bd57

SHA1
5a2092125ef690ee978dbf8e3f11aa12ab54bf03

SHA256
6955361054f12abd2730d100307cc11eacfbd2e49f778391b6583b89f30b9387

SHA512
c64776f0d0ec2bde717c1f0cdb31273cd4e0bff1623f963de4d635beac39f495085f516c1b4fbc541ac3796c7e7259bd979b61569a9d61f912edef282378ae63

Download Submit
memory/868-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download