e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096

Analysis

max time kernel
56s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:38

Target

e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096.exe
Size

37KB
MD5

1ae54e427e271927f753f1dd52734f50
SHA1

49ca7cd3f2a86e6666b48df1161d81263bc749aa
SHA256

e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096
SHA512

945f143163b58df98cd19bc4b6362fe6029bf90bf2fad88785c3771ce43367e60124f2f439f7d57c2ebec36d082cebe2cc07ea367f6ef73216550296e7634576
SSDEEP

768:P3amUkTe2uVf8VPZUpRwqK8RPRDUVojyH6ERXXpQRWzee6qg6i2essYmwvV8nLrD:fa9iexVfeva6ojyHFRXXpQRWzee6v9Ya

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1420	vgtdcg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vgtdcg.exe	e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096.exe
File opened for modification	C:\Windows\SysWOW64\vgtdcg.exe	e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 1292	1420	vgtdcg.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1780	e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1292	1420	vgtdcg.exe	29
PID 1420 wrote to memory of 1292	1420	vgtdcg.exe	29
PID 1420 wrote to memory of 1292	1420	vgtdcg.exe	29
PID 1420 wrote to memory of 1292	1420	vgtdcg.exe	29
PID 1420 wrote to memory of 1292	1420	vgtdcg.exe	29
PID 1420 wrote to memory of 1292	1420	vgtdcg.exe	29

C:\Windows\SysWOW64\vgtdcg.exe

Filesize
37KB

MD5
1ae54e427e271927f753f1dd52734f50

SHA1
49ca7cd3f2a86e6666b48df1161d81263bc749aa

SHA256
e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096

SHA512
945f143163b58df98cd19bc4b6362fe6029bf90bf2fad88785c3771ce43367e60124f2f439f7d57c2ebec36d082cebe2cc07ea367f6ef73216550296e7634576

Download Submit
C:\Windows\SysWOW64\vgtdcg.exe

Filesize
37KB

MD5
1ae54e427e271927f753f1dd52734f50

SHA1
49ca7cd3f2a86e6666b48df1161d81263bc749aa

SHA256
e8cd8defc178370a4cbe8960dc60d6a847714f10bef8ac48bcb710a8bffbd096

SHA512
945f143163b58df98cd19bc4b6362fe6029bf90bf2fad88785c3771ce43367e60124f2f439f7d57c2ebec36d082cebe2cc07ea367f6ef73216550296e7634576

Download Submit
memory/1292-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1292-58-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download