e74e9a6d116307010f36d4964cd30021cde83a303f6f130d1f371424ed262c4e

Analysis

max time kernel
39s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 03:43

Target

e74e9a6d116307010f36d4964cd30021cde83a303f6f130d1f371424ed262c4e.exe
Size

51KB
MD5

083878165465c713ce4bf95441001fc6
SHA1

895438e9d2ca6229ba17d4c2ce1a408256d9ac2d
SHA256

e74e9a6d116307010f36d4964cd30021cde83a303f6f130d1f371424ed262c4e
SHA512

074fc6ccc894be9110d0ef17d0893b1b1825fb11e3148a4a21d9b9d33660ec1871f904d8b20a3375fa34b35777fca1b15cb4d16f979a4d19c9384405cacf1c5a
SSDEEP

768:Vvdv6GHnHKMBg93qHbGjZDImJN1XT+yHRV1firwzb5:VlvRHzAaHfmJ+yHRrig5

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
696	vgtdcg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vgtdcg.exe	e74e9a6d116307010f36d4964cd30021cde83a303f6f130d1f371424ed262c4e.exe
File opened for modification	C:\Windows\SysWOW64\vgtdcg.exe	e74e9a6d116307010f36d4964cd30021cde83a303f6f130d1f371424ed262c4e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 696 set thread context of 1144	696	vgtdcg.exe	27

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1096	e74e9a6d116307010f36d4964cd30021cde83a303f6f130d1f371424ed262c4e.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 1144	696	vgtdcg.exe	27
PID 696 wrote to memory of 1144	696	vgtdcg.exe	27
PID 696 wrote to memory of 1144	696	vgtdcg.exe	27
PID 696 wrote to memory of 1144	696	vgtdcg.exe	27
PID 696 wrote to memory of 1144	696	vgtdcg.exe	27
PID 696 wrote to memory of 1144	696	vgtdcg.exe	27

C:\Windows\SysWOW64\vgtdcg.exe

Filesize
51KB

MD5
083878165465c713ce4bf95441001fc6

SHA1
895438e9d2ca6229ba17d4c2ce1a408256d9ac2d

SHA256
e74e9a6d116307010f36d4964cd30021cde83a303f6f130d1f371424ed262c4e

SHA512
074fc6ccc894be9110d0ef17d0893b1b1825fb11e3148a4a21d9b9d33660ec1871f904d8b20a3375fa34b35777fca1b15cb4d16f979a4d19c9384405cacf1c5a

Download Submit
C:\Windows\SysWOW64\vgtdcg.exe

Filesize
51KB

MD5
083878165465c713ce4bf95441001fc6

SHA1
895438e9d2ca6229ba17d4c2ce1a408256d9ac2d

SHA256
e74e9a6d116307010f36d4964cd30021cde83a303f6f130d1f371424ed262c4e

SHA512
074fc6ccc894be9110d0ef17d0893b1b1825fb11e3148a4a21d9b9d33660ec1871f904d8b20a3375fa34b35777fca1b15cb4d16f979a4d19c9384405cacf1c5a

Download Submit
memory/1096-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1144-58-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1144-60-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download