ef12898e74dc995d41484db166973761fbf74b4221ddf779e88dcb458b6b2089

Analysis

max time kernel
144s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 05:01

Target

ef12898e74dc995d41484db166973761fbf74b4221ddf779e88dcb458b6b2089.exe
Size

143KB
MD5

798916000f7d6e42730737c28b47d5ff
SHA1

15ae4624d5e3e950ba7adeeec1710694d06014de
SHA256

ef12898e74dc995d41484db166973761fbf74b4221ddf779e88dcb458b6b2089
SHA512

28835d048d3a9c328384f51804e7a93ff47fc0fba678e4c9ee2c824c6158ea9a33a86103aad1b936131aead10b84b9ea5b6786dac267ad3cda3961fc45453139
SSDEEP

1536:odZX0qN1OpoxlauVSzvjGjKb0k7hoRoJdUwfyrz15JpYLZbM2wPJrMoszS5:od2EOpo3SzsPk0BwKrz1IWPJrMoN

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
4036	Wjwivth
1420	Wjwivth

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 1420	4036	Wjwivth	89
PID 4036 wrote to memory of 1420	4036	Wjwivth	89
PID 4036 wrote to memory of 1420	4036	Wjwivth	89

C:\Users\Admin\AppData\Local\Temp\ef12898e74dc995d41484db166973761fbf74b4221ddf779e88dcb458b6b2089.exe
"C:\Users\Admin\AppData\Local\Temp\ef12898e74dc995d41484db166973761fbf74b4221ddf779e88dcb458b6b2089.exe"
1⤵
PID:2136

C:\ProgramData\Wjwivth
C:\ProgramData\Wjwivth
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036
- C:\ProgramData\Wjwivth
  C:\ProgramData\Wjwivth Win7
  2⤵
  - Executes dropped EXE
  PID:1420

C:\ProgramData\Wjwivth

Filesize
143KB

MD5
798916000f7d6e42730737c28b47d5ff

SHA1
15ae4624d5e3e950ba7adeeec1710694d06014de

SHA256
ef12898e74dc995d41484db166973761fbf74b4221ddf779e88dcb458b6b2089

SHA512
28835d048d3a9c328384f51804e7a93ff47fc0fba678e4c9ee2c824c6158ea9a33a86103aad1b936131aead10b84b9ea5b6786dac267ad3cda3961fc45453139

Download Submit
C:\ProgramData\Wjwivth

Filesize
143KB

MD5
798916000f7d6e42730737c28b47d5ff

SHA1
15ae4624d5e3e950ba7adeeec1710694d06014de

SHA256
ef12898e74dc995d41484db166973761fbf74b4221ddf779e88dcb458b6b2089

SHA512
28835d048d3a9c328384f51804e7a93ff47fc0fba678e4c9ee2c824c6158ea9a33a86103aad1b936131aead10b84b9ea5b6786dac267ad3cda3961fc45453139

Download Submit
C:\ProgramData\Wjwivth

Filesize
143KB

MD5
798916000f7d6e42730737c28b47d5ff

SHA1
15ae4624d5e3e950ba7adeeec1710694d06014de

SHA256
ef12898e74dc995d41484db166973761fbf74b4221ddf779e88dcb458b6b2089

SHA512
28835d048d3a9c328384f51804e7a93ff47fc0fba678e4c9ee2c824c6158ea9a33a86103aad1b936131aead10b84b9ea5b6786dac267ad3cda3961fc45453139

Download Submit
memory/2136-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download