0b9ac0a0181bbe4dd1a470bc677abba1c6eabcff1b8d7e9dc2faf7161708a7dc

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 18:32

Target

0b9ac0a0181bbe4dd1a470bc677abba1c6eabcff1b8d7e9dc2faf7161708a7dcN.exe
Size

74KB
MD5

d1133c1c81c5ad5c0a70aa12bc5be6e0
SHA1

a56411d70be258689683952b54673d57a59cc8ba
SHA256

0b9ac0a0181bbe4dd1a470bc677abba1c6eabcff1b8d7e9dc2faf7161708a7dc
SHA512

e9947df6f984f90f1db9cdef6af6f14ae4da0302189a823dbdf73255e4e5ecea6a037152bc599eda0283d3ed3e53ab10419be2a82ede66e315f708f1f9d37669
SSDEEP

1536:1YF8NLCofRLCg/pdsHT+obdo8Cgzvl4ooofgke253u2DW4Ws:uF+LCofRLCgxSzXo8CgpIo53u2DW4Ws

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2508	ucruhean-idur.exe

Loads dropped DLL 1 IoCs

pid	Process
1708	0b9ac0a0181bbe4dd1a470bc677abba1c6eabcff1b8d7e9dc2faf7161708a7dcN.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ucruhean-idur.exe	0b9ac0a0181bbe4dd1a470bc677abba1c6eabcff1b8d7e9dc2faf7161708a7dcN.exe
File created	C:\Windows\SysWOW64\ucruhean-idur.exe	0b9ac0a0181bbe4dd1a470bc677abba1c6eabcff1b8d7e9dc2faf7161708a7dcN.exe

C:\Users\Admin\AppData\Local\Temp\0b9ac0a0181bbe4dd1a470bc677abba1c6eabcff1b8d7e9dc2faf7161708a7dcN.exe
"C:\Users\Admin\AppData\Local\Temp\0b9ac0a0181bbe4dd1a470bc677abba1c6eabcff1b8d7e9dc2faf7161708a7dcN.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:1708
- C:\Windows\SysWOW64\ucruhean-idur.exe
  "C:\Windows\SysWOW64\ucruhean-idur.exe"
  2⤵
  - Executes dropped EXE
  PID:2508

C:\Windows\SysWOW64\ucruhean-idur.exe

Filesize
71KB

MD5
b24d7ae2dfaf4a34449ffe5cb796c2d5

SHA1
babc0687204557076dc5624e44fd56d087c6f480

SHA256
109389a3dedc50290b42d2574789755d93026e8a9a478dab47d541f3c5a16998

SHA512
9372a71ddb066e102a130b065c2ba2380ae68d4d72115dc90568949cf3f9e23eb9bf549dccd61997211b310ac64b01ceba726d1364f10f37eeaef3c5b82581f2

Download Submit
memory/1708-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download