ffb9b3e3f65f587aab02594bcd002c724f8b1ad81bc6c38ab734f0d82123ae6d

Analysis

max time kernel
65s
max time network
63s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/05/2023, 14:49

Target

091herpaLM.exe
Size

165KB
MD5

def1e5c4a64d90b690668bc0330387a5
SHA1

294b8bc3dd3e5f2029b183b3ac3212c0b4bc38e1
SHA256

ffb9b3e3f65f587aab02594bcd002c724f8b1ad81bc6c38ab734f0d82123ae6d
SHA512

9ede6018a727066f7b29f7e2f996d03749d3f46fe0d6d5865878fa25ce65630db2d87857b2f978abaeae25938279a53c89bcd70a4b54f3bc2071ae0424081d6c
SSDEEP

3072:Yf+GYrgxI0c5XI/NklH0iNL2Sl8BJoNEWoY46Uolwe4Rh:ndr0I0c5XICuiNLnluOdohPolCR

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
908	dqiawpkg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 908	1372	091herpaLM.exe
PID 1372 wrote to memory of 908	1372	091herpaLM.exe	27

C:\Users\Admin\AppData\Local\Temp\091herpaLM.exe
"C:\Users\Admin\AppData\Local\Temp\091herpaLM.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- \Users\Admin\AppData\Local\Temp\dqiawpkg.exe
  2⤵
  - Executes dropped EXE
  PID:908

C:\Users\Admin\AppData\Local\Temp\dqiawpkg.exe

Filesize
897KB

MD5
10e4a1d2132ccb5c6759f038cdb6f3c9

SHA1
42d36eeb2140441b48287b7cd30b38105986d68f

SHA256
c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b

SHA512
9bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d

Download Submit
memory/908-54-0x0000000000010000-0x0000000000012000-memory.dmp

Filesize
8KB

Download
memory/908-55-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

Filesize
4KB

Download
memory/908-58-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download