66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 23:20

Target
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/Byr723V3Cq1.exe
Size 5.6MB
Sample240811-3bewdaybpc
SHA256 f7b154b559d43433246b75a5294f260ecf11a1e03a77264b037c9d54a14315da
MD5 05396b1d29a97b383fbd638b1f9355a9
SHA1 34123ced194bfb10bab574555784e4bf43b97c8c
SHA512 b4de31b07c9dea35c37ec4ec5ee7eb4d46fa6a25801238ee36e859166f7f46dd033dde0abcc8184a63209e9d69a79ced5103e2a97f1d0dd4827706ee35c503bd
SSDEEP 98304:ETIF0v7xEkVfXhspQU9hP3P0yM5bOxetYqzxiU6WCTHXqj97sWl+0xGL:ENvqCfRsa03PZMceDMU6WcI93zx
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1940	Byr723V3Cq1.exe
1940	Byr723V3Cq1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 112	1940	Byr723V3Cq1.exe	31
PID 1940 wrote to memory of 112	1940	Byr723V3Cq1.exe	31
PID 1940 wrote to memory of 112	1940	Byr723V3Cq1.exe	31
PID 112 wrote to memory of 2108	112	cmd.exe	32
PID 112 wrote to memory of 2108	112	cmd.exe	32
PID 112 wrote to memory of 2108	112	cmd.exe	32
PID 112 wrote to memory of 2012	112	cmd.exe	33
PID 112 wrote to memory of 2012	112	cmd.exe	33
PID 112 wrote to memory of 2012	112	cmd.exe	33
PID 112 wrote to memory of 896	112	cmd.exe	34
PID 112 wrote to memory of 896	112	cmd.exe	34
PID 112 wrote to memory of 896	112	cmd.exe	34
PID 1940 wrote to memory of 2892	1940	Byr723V3Cq1.exe	35
PID 1940 wrote to memory of 2892	1940	Byr723V3Cq1.exe	35
PID 1940 wrote to memory of 2892	1940	Byr723V3Cq1.exe	35

C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\Byr723V3Cq1.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\Byr723V3Cq1.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\Byr723V3Cq1.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\Byr723V3Cq1.exe" MD5
    3⤵
    PID:2108
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2012
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2892

memory/1940-2-0x0000000077430000-0x0000000077432000-memory.dmp

Download

memory/1940-0-0x0000000077430000-0x0000000077432000-memory.dmp

Download

memory/1940-4-0x0000000077430000-0x0000000077432000-memory.dmp

Download

memory/1940-10-0x000000013F9F0000-0x00000001403CF000-memory.dmp

Download

memory/1940-8-0x000000013FA8A000-0x000000013FE2D000-memory.dmp

Download

memory/1940-5-0x000000013F9F0000-0x00000001403CF000-memory.dmp

Download

memory/1940-11-0x000000013FA8A000-0x000000013FE2D000-memory.dmp

Download

memory/1940-12-0x000000013F9F0000-0x00000001403CF000-memory.dmp

Download