cf6e975155c56daba21defa295e2324df5a6b4171e6513a792aa7a79bb0ccc10

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2023 00:12

Target

cf6e975155c56daba21defa295e2324df5a6b4171e6513a792aa7a79bb0ccc10.exe
Size

472KB
MD5

e175ed2b4e8eb7e32cf055dd0cbb48a4
SHA1

c9326487573870c66ad0f9745024cbfd93d08f07
SHA256

cf6e975155c56daba21defa295e2324df5a6b4171e6513a792aa7a79bb0ccc10
SHA512

57d51ce075085c12856270918d197f8cdc9610406d2a5a3a2aa4c630331d33c1784846fe2401507699757d55ccfe966b0705e8afa36779effae9037aad2c2a5e
SSDEEP

3072:+nO6CPsH+cNDzsxfiTFpQALiaLNdM/5njwa1tP:QO6CUecNDwJiYA2GdijZ

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
4100	Gjqlybv
3240	Gjqlybv

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3240	4100	Gjqlybv	93
PID 4100 wrote to memory of 3240	4100	Gjqlybv	93
PID 4100 wrote to memory of 3240	4100	Gjqlybv	93

C:\Users\Admin\AppData\Local\Temp\cf6e975155c56daba21defa295e2324df5a6b4171e6513a792aa7a79bb0ccc10.exe
"C:\Users\Admin\AppData\Local\Temp\cf6e975155c56daba21defa295e2324df5a6b4171e6513a792aa7a79bb0ccc10.exe"
1⤵
PID:2776

C:\ProgramData\Gjqlybv
C:\ProgramData\Gjqlybv
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100
- C:\ProgramData\Gjqlybv
  C:\ProgramData\Gjqlybv Win7
  2⤵
  - Executes dropped EXE
  PID:3240

C:\ProgramData\Gjqlybv

Filesize
472KB

MD5
e175ed2b4e8eb7e32cf055dd0cbb48a4

SHA1
c9326487573870c66ad0f9745024cbfd93d08f07

SHA256
cf6e975155c56daba21defa295e2324df5a6b4171e6513a792aa7a79bb0ccc10

SHA512
57d51ce075085c12856270918d197f8cdc9610406d2a5a3a2aa4c630331d33c1784846fe2401507699757d55ccfe966b0705e8afa36779effae9037aad2c2a5e

Download Submit
C:\ProgramData\Gjqlybv

Filesize
472KB

MD5
e175ed2b4e8eb7e32cf055dd0cbb48a4

SHA1
c9326487573870c66ad0f9745024cbfd93d08f07

SHA256
cf6e975155c56daba21defa295e2324df5a6b4171e6513a792aa7a79bb0ccc10

SHA512
57d51ce075085c12856270918d197f8cdc9610406d2a5a3a2aa4c630331d33c1784846fe2401507699757d55ccfe966b0705e8afa36779effae9037aad2c2a5e

Download Submit
C:\ProgramData\Gjqlybv

Filesize
472KB

MD5
e175ed2b4e8eb7e32cf055dd0cbb48a4

SHA1
c9326487573870c66ad0f9745024cbfd93d08f07

SHA256
cf6e975155c56daba21defa295e2324df5a6b4171e6513a792aa7a79bb0ccc10

SHA512
57d51ce075085c12856270918d197f8cdc9610406d2a5a3a2aa4c630331d33c1784846fe2401507699757d55ccfe966b0705e8afa36779effae9037aad2c2a5e

Download Submit
memory/2776-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download