40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 09:08

Target

40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe
Size

7.2MB
MD5

9606143c857bbfe1b1da8e3d1fa9ae0e
SHA1

cb3a1b1d8e6acbe46c96b5b159a7be2d372b3cc6
SHA256

40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b
SHA512

2e118c618265b8769b15dff8add661c60f17afd46365773ca22e359b03a765c83a7f316057045293a71b53a889771fadf54e6ac1ee3fd9b3a7437f266f8af08b
SSDEEP

196608:jeuNPzUCugRPeW7R9dGfqEjirb49GOD2MpkB:CmZB77R9d0q1A9GLM

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2784	2416	40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe	28
PID 2416 wrote to memory of 2784	2416	40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe	28
PID 2416 wrote to memory of 2784	2416	40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe	28
PID 2416 wrote to memory of 2784	2416	40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe	28
PID 2784 wrote to memory of 2664	2784	cmd.exe	30
PID 2784 wrote to memory of 2664	2784	cmd.exe	30
PID 2784 wrote to memory of 2664	2784	cmd.exe	30
PID 2784 wrote to memory of 2664	2784	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe
"C:\Users\Admin\AppData\Local\Temp\40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c tzutil /g
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\tzutil.exe
    tzutil /g
    3⤵
    PID:2664

memory/2416-0-0x0000000000DA0000-0x0000000001814000-memory.dmp

Filesize
10.5MB

Download
memory/2416-4-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2416-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2416-7-0x0000000000840000-0x0000000000940000-memory.dmp

Filesize
1024KB

Download
memory/2416-9-0x0000000000840000-0x0000000000940000-memory.dmp

Filesize
1024KB

Download