32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:39

Target

32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe
Size

725KB
MD5

8635663044bfaedb51f2e804712456bd
SHA1

f88a26dc55f609adaa19ad29a97db25d3911f8aa
SHA256

32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52
SHA512

a23265bc76a356044a4546be964a8e772b05a0a680856a4b6ab2681c1c16fff245936107cd49c25d24369cd11e608cb5d2e22a43655ed29f3ea9a56d39fc18fc
SSDEEP

12288:ubnrXLD7m/QmIT/yuPH+7kuffOnveHw0ARexgIHfRcCOi1:O7fmEPH+7VnOWH3JqCOi1

Score

8^/10

Executes dropped EXE 2 IoCs

Processes:

ZZND3ODBWIOUDGBW9IDGW3IDGDZZND3ODBWIOUDGBW9IDGW3IDGD

pid process

2368 ZZND3ODBWIOUDGBW9IDGW3IDGD
4884 ZZND3ODBWIOUDGBW9IDGW3IDGD

pid	process
2368	ZZND3ODBWIOUDGBW9IDGW3IDGD
4884	ZZND3ODBWIOUDGBW9IDGW3IDGD

Drops startup file 1 IoCs

Processes:

32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZZH83DHO932BDOG928G3FBD2ODH.vbs	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exeZZND3ODBWIOUDGBW9IDGW3IDGD

description	pid	process	target process
PID 760 wrote to memory of 2368	760	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 760 wrote to memory of 2368	760	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 760 wrote to memory of 2368	760	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 760 wrote to memory of 4884	760	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 760 wrote to memory of 4884	760	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 760 wrote to memory of 4884	760	32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe	ZZND3ODBWIOUDGBW9IDGW3IDGD
PID 2368 wrote to memory of 1512	2368	ZZND3ODBWIOUDGBW9IDGW3IDGD	iexplore.exe
PID 2368 wrote to memory of 1512	2368	ZZND3ODBWIOUDGBW9IDGW3IDGD	iexplore.exe
PID 2368 wrote to memory of 1512	2368	ZZND3ODBWIOUDGBW9IDGW3IDGD	iexplore.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:1512

C:\Users\Admin\AppData\Roaming\ZZND3ODBWIOUDGBW9IDGW3IDGD
"C:\Users\Admin\AppData\Roaming\ZZND3ODBWIOUDGBW9IDGW3IDGD" M5T3X EHAOFKUHB "C:\Users\Admin\AppData\Local\Temp\32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52.exe"
2⤵
- Executes dropped EXE
PID:4884

C:\Users\Admin\AppData\Roaming\ZZND3ODBWIOUDGBW9IDGW3IDGD

Filesize
725KB

MD5
8635663044bfaedb51f2e804712456bd

SHA1
f88a26dc55f609adaa19ad29a97db25d3911f8aa

SHA256
32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52

SHA512
a23265bc76a356044a4546be964a8e772b05a0a680856a4b6ab2681c1c16fff245936107cd49c25d24369cd11e608cb5d2e22a43655ed29f3ea9a56d39fc18fc

Download Submit
C:\Users\Admin\AppData\Roaming\ZZND3ODBWIOUDGBW9IDGW3IDGD

Filesize
725KB

MD5
8635663044bfaedb51f2e804712456bd

SHA1
f88a26dc55f609adaa19ad29a97db25d3911f8aa

SHA256
32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52

SHA512
a23265bc76a356044a4546be964a8e772b05a0a680856a4b6ab2681c1c16fff245936107cd49c25d24369cd11e608cb5d2e22a43655ed29f3ea9a56d39fc18fc

Download Submit
C:\Users\Admin\AppData\Roaming\ZZND3ODBWIOUDGBW9IDGW3IDGD

Filesize
725KB

MD5
8635663044bfaedb51f2e804712456bd

SHA1
f88a26dc55f609adaa19ad29a97db25d3911f8aa

SHA256
32162127da77c66c0ea5f319866632d37465d61d9c8df1b336d5981a39693a52

SHA512
a23265bc76a356044a4546be964a8e772b05a0a680856a4b6ab2681c1c16fff245936107cd49c25d24369cd11e608cb5d2e22a43655ed29f3ea9a56d39fc18fc

Download Submit
memory/2368-132-0x0000000000000000-mapping.dmp

Download
memory/4884-134-0x0000000000000000-mapping.dmp

Download