fb9c25da973a81fbbaca16011aba651bf9b5e1d98f1f1a5a500ab00c781ebcb8

Resubmissions

29/06/2024, 20:48

29/06/2024, 20:47

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 20:48

Target

Dustman.exe
Size

258KB
MD5

8afa8a59eebf43ef223be52e08fcdc67
SHA1

e3ae32ebe8465c7df1225a51234f13e8a44969cc
SHA256

f07b0c79a8c88a5760847226af277cf34ab5508394a58820db4db5a8d0340fc7
SHA512

b3192d96307e91a988e1c653457dd09ffbdcacf9770cdc3dbc4985443f2ed1343c0088f989ae77b6b0944a5f608af9597c8c8218f0c1456d8cccff15cc6d744d
SSDEEP

6144:h2+Z0A0chhA+AosUTvc2Y8Y7wyjo7m9nnnhNS:h2U0chhA7fUTE2Y8Y7LjJU

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
1160	agent.exe
3048	agent.exe

Loads dropped DLL 10 IoCs

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1068	2060	Dustman.exe	29
PID 2060 wrote to memory of 1068	2060	Dustman.exe	29
PID 2060 wrote to memory of 1068	2060	Dustman.exe	29
PID 2060 wrote to memory of 2368	2060	Dustman.exe	30
PID 2060 wrote to memory of 2368	2060	Dustman.exe	30
PID 2060 wrote to memory of 2368	2060	Dustman.exe	30
PID 1068 wrote to memory of 1160	1068	cmd.exe	33
PID 1068 wrote to memory of 1160	1068	cmd.exe	33
PID 1068 wrote to memory of 1160	1068	cmd.exe	33
PID 2368 wrote to memory of 3048	2368	cmd.exe	34
PID 2368 wrote to memory of 3048	2368	cmd.exe	34
PID 2368 wrote to memory of 3048	2368	cmd.exe	34
PID 3048 wrote to memory of 2536	3048	agent.exe	35
PID 3048 wrote to memory of 2536	3048	agent.exe	35
PID 3048 wrote to memory of 2536	3048	agent.exe	35
PID 1160 wrote to memory of 2112	1160	agent.exe	36
PID 1160 wrote to memory of 2112	1160	agent.exe	36
PID 1160 wrote to memory of 2112	1160	agent.exe	36

C:\Users\Admin\AppData\Local\Temp\Dustman.exe
"C:\Users\Admin\AppData\Local\Temp\Dustman.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\windows\system32\cmd.exe
  /c agent.exe C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Users\Admin\AppData\Local\Temp\agent.exe
    agent.exe C
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1160 -s 36
      4⤵
      Loads dropped DLL
      PID:2112
- C:\windows\system32\cmd.exe
  /c agent.exe F
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\agent.exe
    agent.exe F
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3048 -s 36
      4⤵
      Loads dropped DLL
      PID:2536

\Users\Admin\AppData\Local\Temp\agent.exe

Filesize
113KB

MD5
f5f8160fe8468a77b6a495155c3dacea

SHA1
20d61c337653392ea472352931820dc60c37b2bc

SHA256
44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2

SHA512
c65b86d579f7c0defba655ce440a20f1bb5447e058861540e92d80968131d40cc9fa42defb2c613d92de323f42301f59eacc6cfce5f34ca2c2170f0692919db8

Download Submit