66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 23:20

Target

Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/Byr723V3Cq1.exe
Size

5.6MB
MD5

05396b1d29a97b383fbd638b1f9355a9
SHA1

34123ced194bfb10bab574555784e4bf43b97c8c
SHA256

f7b154b559d43433246b75a5294f260ecf11a1e03a77264b037c9d54a14315da
SHA512

b4de31b07c9dea35c37ec4ec5ee7eb4d46fa6a25801238ee36e859166f7f46dd033dde0abcc8184a63209e9d69a79ced5103e2a97f1d0dd4827706ee35c503bd
SSDEEP

98304:ETIF0v7xEkVfXhspQU9hP3P0yM5bOxetYqzxiU6WCTHXqj97sWl+0xGL:ENvqCfRsa03PZMceDMU6WcI93zx

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Byr723V3Cq1.exe

pid process

1940 Byr723V3Cq1.exe
1940 Byr723V3Cq1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Byr723V3Cq1.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Byr723V3Cq1.execmd.exe

description	pid	process	target process
PID 1940 wrote to memory of 112	1940	Byr723V3Cq1.exe	cmd.exe
PID 1940 wrote to memory of 112	1940	Byr723V3Cq1.exe	cmd.exe
PID 1940 wrote to memory of 112	1940	Byr723V3Cq1.exe	cmd.exe
PID 112 wrote to memory of 2108	112	cmd.exe	certutil.exe
PID 112 wrote to memory of 2108	112	cmd.exe	certutil.exe
PID 112 wrote to memory of 2108	112	cmd.exe	certutil.exe
PID 112 wrote to memory of 2012	112	cmd.exe	find.exe
PID 112 wrote to memory of 2012	112	cmd.exe	find.exe
PID 112 wrote to memory of 2012	112	cmd.exe	find.exe
PID 112 wrote to memory of 896	112	cmd.exe	find.exe
PID 112 wrote to memory of 896	112	cmd.exe	find.exe
PID 112 wrote to memory of 896	112	cmd.exe	find.exe
PID 1940 wrote to memory of 2892	1940	Byr723V3Cq1.exe	cmd.exe
PID 1940 wrote to memory of 2892	1940	Byr723V3Cq1.exe	cmd.exe
PID 1940 wrote to memory of 2892	1940	Byr723V3Cq1.exe	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\Byr723V3Cq1.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\Byr723V3Cq1.exe" MD5
3⤵
PID:2108

memory/1940-2-0x0000000077430000-0x0000000077432000-memory.dmp

Filesize
8KB

Download
memory/1940-0-0x0000000077430000-0x0000000077432000-memory.dmp

Filesize
8KB

Download
memory/1940-4-0x0000000077430000-0x0000000077432000-memory.dmp

Filesize
8KB

Download
memory/1940-10-0x000000013F9F0000-0x00000001403CF000-memory.dmp

Filesize
9.9MB

Download
memory/1940-8-0x000000013FA8A000-0x000000013FE2D000-memory.dmp

Filesize
3.6MB

Download
memory/1940-5-0x000000013F9F0000-0x00000001403CF000-memory.dmp

Filesize
9.9MB

Download
memory/1940-11-0x000000013FA8A000-0x000000013FE2D000-memory.dmp

Filesize
3.6MB

Download
memory/1940-12-0x000000013F9F0000-0x00000001403CF000-memory.dmp

Filesize
9.9MB

Download