c7744eaa3921c46fb429c5f69a4cc0ab36502f19f00dd7463e472485dd1ac97f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 04:42

Target

c7744eaa3921c46fb429c5f69a4cc0ab36502f19f00dd7463e472485dd1ac97f.exe
Size

94KB
MD5

7eca76f3229628f835e635547a8ba915
SHA1

f2f8d66c103624344dd43333913c37d71f80c512
SHA256

c7744eaa3921c46fb429c5f69a4cc0ab36502f19f00dd7463e472485dd1ac97f
SHA512

0ddc8b374bea9e6a2598a6df6139b9084ecee9c3f4ccf087b93665d83d3ccb5b98254209a8d62563e845483ca6ebc97999d1dd1ce6252e2e49c62dcbeb5852c8
SSDEEP

1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OL+G7mJAm/lGAuJMLF4vsnXWkW316:SdV1Z1i3QKqSGCJr/lkJ6FQsnV

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1592	sppsrv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xpwunp.dat	c7744eaa3921c46fb429c5f69a4cc0ab36502f19f00dd7463e472485dd1ac97f.exe
File created	C:\Windows\SysWOW64\sppsrv.exe	c7744eaa3921c46fb429c5f69a4cc0ab36502f19f00dd7463e472485dd1ac97f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 3948	4844	c7744eaa3921c46fb429c5f69a4cc0ab36502f19f00dd7463e472485dd1ac97f.exe	85
PID 4844 wrote to memory of 3948	4844	c7744eaa3921c46fb429c5f69a4cc0ab36502f19f00dd7463e472485dd1ac97f.exe	85
PID 4844 wrote to memory of 3948	4844	c7744eaa3921c46fb429c5f69a4cc0ab36502f19f00dd7463e472485dd1ac97f.exe	85

C:\Users\Admin\AppData\Local\Temp\c7744eaa3921c46fb429c5f69a4cc0ab36502f19f00dd7463e472485dd1ac97f.exe
"C:\Users\Admin\AppData\Local\Temp\c7744eaa3921c46fb429c5f69a4cc0ab36502f19f00dd7463e472485dd1ac97f.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_del.bat
  2⤵
  PID:3948

C:\Windows\SysWOW64\sppsrv.exe
C:\Windows\SysWOW64\sppsrv.exe
1⤵
- Executes dropped EXE
PID:1592

C:\Users\Admin\AppData\Local\Temp\_del.bat

Filesize
294B

MD5
f6b3d3659d557f2dcc10766b3ade8ae3

SHA1
41a4da4280d319535426845691c1e18a2fd098ea

SHA256
0563055718f8e8560b28809b991cc1a71ef490f18e8fdb5ebfdda35e5ab26a00

SHA512
fff4be2b724426cc956d0cf0068352c35b3c58d8cc497fedf471dd9922abc5f462d1f9ba3166676d89ae8ad2141b2b4d09cfd0fc750bb47faf5953f626343dc5

Download Submit
C:\Windows\SysWOW64\sppsrv.exe

Filesize
94KB

MD5
4bb469da06d93fa8f0c32aef37ac7359

SHA1
df684b710ca78767f1573be8b81fa088fbbf04e0

SHA256
5ac4bf2b10cbf5ae280ff43a33eb2b525e7da332707dcee84afe5ed67b349def

SHA512
c015f3a7fd3a8caedc70061733d94de9bded1dd330e7b33323c85674658f5b7ac2253394bcbfedfdf3f79f2d328cfe1975fa2e99302636c19cf65c985b398502

Download Submit
C:\Windows\SysWOW64\xpwunp.dat

Filesize
740B

MD5
ebf1d1bfc450972600f157620b712f55

SHA1
509abab67859de3ac16e576dfe84923bb0a2e486

SHA256
19b9a5926c277bcc46a8967bd6c84975d5cb74fd0a4f6771d0eb3c0f7eb1d6b3

SHA512
f4585e823ac5dfd356eb29364d54f4f676473a9b0da0bd2e56647eb5ccce4d653b80438254100979da717c050801ea012d51812107bb7677ca15f59fcb95bca3

Download Submit