40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 05:43

Target

40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6.exe
Size

1.3MB
MD5

fd30f3a2dd525c009bc289aa6adf3566
SHA1

1d85109920e8d56f1b84096eba24b860f25e7edb
SHA256

40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6
SHA512

ebb6792c816746d5af63382909432366cdf7ff86cab8231e85caf8f3819caf20446736af0c8839f8bdebe3eea2987e716198a1b7e3af94ff53b89400893437f6
SSDEEP

24576:0Hyi0YRzZgx/jtTObFtURiRQkzRQD9ZkdxTu5iZpUHLQfRRN:HIIhTObMbIItry

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
580	notepad.exe

Loads dropped DLL 2 IoCs

pid	Process
2084	cmd.exe
2084	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2360	1984	40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6.exe	30
PID 1984 wrote to memory of 2360	1984	40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6.exe	30
PID 1984 wrote to memory of 2360	1984	40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6.exe	30
PID 1984 wrote to memory of 2084	1984	40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6.exe	31
PID 1984 wrote to memory of 2084	1984	40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6.exe	31
PID 1984 wrote to memory of 2084	1984	40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6.exe	31
PID 1984 wrote to memory of 3008	1984	40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6.exe	32
PID 1984 wrote to memory of 3008	1984	40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6.exe	32
PID 1984 wrote to memory of 3008	1984	40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6.exe	32
PID 2084 wrote to memory of 580	2084	cmd.exe	36
PID 2084 wrote to memory of 580	2084	cmd.exe	36
PID 2084 wrote to memory of 580	2084	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6.exe
"C:\Users\Admin\AppData\Local\Temp\40ccbe4d4a5bf8bed3b1fdbf586162ac7046fad1a68400539d9a6f827b1357b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\cmd.exe
  cmd /k start ÈÎìÇ-ÖÐ¹ú´«Ã½´óÑ§.docx
  2⤵
  PID:2360
- C:\Windows\system32\cmd.exe
  cmd /c C:\Windows\Temp\notepad.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\Temp\notepad.exe
    C:\Windows\Temp\notepad.exe
    3⤵
    - Executes dropped EXE
    PID:580
- C:\Windows\system32\cmd.exe
  cmd /k del ÈÎìÇ-ÖÐ¹ú´«Ã½´óÑ§.exe
  2⤵
  PID:3008

C:\Windows\Temp\notepad.exe

Filesize
831KB

MD5
eaa16e9789f182de10c482e26b374304

SHA1
b53763f592b24ff14b15e1662917c41722299957

SHA256
281a624fcdf4a1c2593a44c436f3523550f31b66ff756f73f1d7e5ebf03d5717

SHA512
c7b1d24b537b63a4ed786f4763dbf287e6c1d5233e36048433ca7ff235f4feeefb68b4ff1d5f7c6763e5993371540f8b6bb373c681bc7b193ba466b647e508e0

Download Submit
memory/580-17-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1984-2-0x0000000000400000-0x0000000000583000-memory.dmp

Filesize
1.5MB

Download
memory/2360-18-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2360-26-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download