cd33fb78d2c17858c0ed68244dc510cf5eec97adc0879eaf63ea90cba5afc424

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 19:39

Target

Perm-Free.exe
Size

575KB
MD5

766ac03a8aee1767929292c6d90cdbee
SHA1

31bbbf8cce9312bc2049c092f05081a56c4b4aa8
SHA256

cd33fb78d2c17858c0ed68244dc510cf5eec97adc0879eaf63ea90cba5afc424
SHA512

838ad62629268041f32f7f30d8f8c506b191dd4ec8bab1270a1678dd9d6d3ae3240ad25ab69a2d05d1073fd3a3f75743317ed7033a838a16a96b1a47ea173ca7
SSDEEP

12288:jCigbjVinkUqtc/5YhZ5tdfELzSizn0SMo+AMYk:GigXV8kri/qZ5tdc6iY7o+AMB

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2972	2536	Perm-Free.exe	31
PID 2536 wrote to memory of 2972	2536	Perm-Free.exe	31
PID 2536 wrote to memory of 2972	2536	Perm-Free.exe	31
PID 2972 wrote to memory of 2068	2972	cmd.exe	32
PID 2972 wrote to memory of 2068	2972	cmd.exe	32
PID 2972 wrote to memory of 2068	2972	cmd.exe	32
PID 2972 wrote to memory of 2356	2972	cmd.exe	33
PID 2972 wrote to memory of 2356	2972	cmd.exe	33
PID 2972 wrote to memory of 2356	2972	cmd.exe	33
PID 2972 wrote to memory of 2044	2972	cmd.exe	34
PID 2972 wrote to memory of 2044	2972	cmd.exe	34
PID 2972 wrote to memory of 2044	2972	cmd.exe	34
PID 2536 wrote to memory of 1616	2536	Perm-Free.exe	35
PID 2536 wrote to memory of 1616	2536	Perm-Free.exe	35
PID 2536 wrote to memory of 1616	2536	Perm-Free.exe	35

C:\Users\Admin\AppData\Local\Temp\Perm-Free.exe
"C:\Users\Admin\AppData\Local\Temp\Perm-Free.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Perm-Free.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Perm-Free.exe" MD5
    3⤵
    PID:2068
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2356
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color E
  2⤵
  PID:1616