4acea05ab0905a50470e55fcb4575e6feee6e7f5ae857bdd388818cee7a562c6

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:10

Target

5271d48de9aafb06b6371ef7035e993215063cc57fa7253ff06ef6a277da772e.exe
Size

66.9MB
MD5

cb980516456576cb91483b0ba7a11dcc
SHA1

408b5698e1740afcc0dcc59d44f688d32f5a73e2
SHA256

5271d48de9aafb06b6371ef7035e993215063cc57fa7253ff06ef6a277da772e
SHA512

7f5257c34dede1efb10be2a01acf65de8e2e8fdd10ef041209cfc46bae0b02bbe6665f120c6cfb9d3c64c54bbe40139adc6a34c02a068fe6b0743172798932fc
SSDEEP

1572864:+1YnA7A8R7tqEwTDYKJbQ0JxcgjnrUBOO8CPdAoIQ4DyRGYluN4fxn:+10A7B+DYKJbndjnoH8Nb/yRPluN4p

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2444	dy3mzwxc.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2424	timeout.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2220	3020	5271d48de9aafb06b6371ef7035e993215063cc57fa7253ff06ef6a277da772e.exe	31
PID 3020 wrote to memory of 2220	3020	5271d48de9aafb06b6371ef7035e993215063cc57fa7253ff06ef6a277da772e.exe	31
PID 3020 wrote to memory of 2220	3020	5271d48de9aafb06b6371ef7035e993215063cc57fa7253ff06ef6a277da772e.exe	31
PID 2220 wrote to memory of 2424	2220	cmd.exe	33
PID 2220 wrote to memory of 2424	2220	cmd.exe	33
PID 2220 wrote to memory of 2424	2220	cmd.exe	33
PID 2220 wrote to memory of 2444	2220	cmd.exe	34
PID 2220 wrote to memory of 2444	2220	cmd.exe	34
PID 2220 wrote to memory of 2444	2220	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\5271d48de9aafb06b6371ef7035e993215063cc57fa7253ff06ef6a277da772e.exe
"C:\Users\Admin\AppData\Local\Temp\5271d48de9aafb06b6371ef7035e993215063cc57fa7253ff06ef6a277da772e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE428.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\system32\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:2424
- - C:\ProgramData\Checking sound status\dy3mzwxc.exe
    "C:\ProgramData\Checking sound status\dy3mzwxc.exe"
    3⤵
    - Executes dropped EXE
    PID:2444

C:\Users\Admin\AppData\Local\Temp\tmpE428.tmp.bat

Filesize
345B

MD5
2c299cb3408714b49f853323babcfd47

SHA1
0f0da5181831eece16cd8f26b8c49d99b5e5f5d6

SHA256
af20f9a84c1e2b97664335dd4e22159647f0f676c153d1c875a3cb905b20060e

SHA512
3d9008445b908dc6780ad66b421f1986e2f100f3208405f4117d4bb255b3c3458b183a29b2bd3e753c51de04311ebf8fe68234c134cb6066f83890bdcd705d4e

Download Submit
memory/2444-14-0x00000000012D0000-0x00000000012D8000-memory.dmp

Filesize
32KB

Download
memory/2444-15-0x000007FEF4DC3000-0x000007FEF4DC4000-memory.dmp

Filesize
4KB

Download
memory/2444-16-0x000007FEF4DC3000-0x000007FEF4DC4000-memory.dmp

Filesize
4KB

Download
memory/3020-0-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

Filesize
4KB

Download
memory/3020-1-0x0000000000D10000-0x0000000000D18000-memory.dmp

Filesize
32KB

Download