1846bbc8741d8d115b13526ade78a25c5fd481557e3652dc2b77d78d126e8324

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 16:08

Target

e67faf6eaa721604c7d2340d80f23860N.exe
Size

68KB
MD5

e67faf6eaa721604c7d2340d80f23860
SHA1

c28c0ec3e485773d3761e62703457f3b74bcd82f
SHA256

1846bbc8741d8d115b13526ade78a25c5fd481557e3652dc2b77d78d126e8324
SHA512

3a72e1d74303a59ce34489e53b459828c5b82bf4b18124cc573a0f0a9e0f568c7ba59851c05b2851e31e6aca3c705a12a1b0bc2320bd47bc8f829ee4fdb24875
SSDEEP

1536:zGDImXUKAO0MIvqLv8Wt4akGrTgzhmO26Mou+Cj/:wImXUxWt4akGXgxg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2884	vusjeson.exe

Loads dropped DLL 1 IoCs

pid	Process
2860	e67faf6eaa721604c7d2340d80f23860N.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	icanhazip.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2884	2860	e67faf6eaa721604c7d2340d80f23860N.exe	30
PID 2860 wrote to memory of 2884	2860	e67faf6eaa721604c7d2340d80f23860N.exe	30
PID 2860 wrote to memory of 2884	2860	e67faf6eaa721604c7d2340d80f23860N.exe	30
PID 2860 wrote to memory of 2884	2860	e67faf6eaa721604c7d2340d80f23860N.exe	30

C:\Users\Admin\AppData\Local\Temp\e67faf6eaa721604c7d2340d80f23860N.exe
"C:\Users\Admin\AppData\Local\Temp\e67faf6eaa721604c7d2340d80f23860N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\vusjeson.exe
  C:\Users\Admin\AppData\Local\Temp\vusjeson.exe
  2⤵
  - Executes dropped EXE
  PID:2884

C:\Users\Admin\AppData\Local\Temp\vusjeson.exe

Filesize
68KB

MD5
7da9b8f6780d7497e6ab09fab90b45f5

SHA1
5cca3fd2b45399ae24796dd6e2203ab752a362a9

SHA256
0ab84512c466cbca58fa960de7ab7c496e751a623822d55244d82d4165392401

SHA512
08367acd890eb02dda7887d22a226e95e64dac29c95b624dd827e40db886cc5b3eb0007aca7623c29ffff3c5b25831bd89be47e6c72bc4160b3149c1ed4c730f

Download Submit
memory/2884-6-0x0000000000403000-0x0000000000405000-memory.dmp

Filesize
8KB

Download