5b1450cff61be58dc14b63f1c3e26ed33cbc8a387c603c5be34e38f3d4275c02

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 19:35

Target

355e00183b3aea992959bd32db884770_exe32_JC.exe
Size

1.1MB
MD5

355e00183b3aea992959bd32db884770
SHA1

647e16720e9a409943899add01c7b2c955821618
SHA256

5b1450cff61be58dc14b63f1c3e26ed33cbc8a387c603c5be34e38f3d4275c02
SHA512

76cbd64e6f8d6f3ebe3ca65ef37a1f7fd66f0e13b55c90457fbf5e877dab98a939a865e51dc7b77cac1a97f33c3b3501b03794c133cdb6e0a137466a26db69d9
SSDEEP

24576:8BJhlR9YTMJjG2oE8xk2ZFquG6OPWCcCBfAKyv9hGYkNruNBWS95:8BJJPJjG2onxk2/zG6rCtM9Q/gBZX

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1364	sqrneufah.exe

Loads dropped DLL 1 IoCs

pid	Process
2684	355e00183b3aea992959bd32db884770_exe32_JC.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\nyjhtyeuc\sqrneufah.exe	355e00183b3aea992959bd32db884770_exe32_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 1364	2684	355e00183b3aea992959bd32db884770_exe32_JC.exe	28
PID 2684 wrote to memory of 1364	2684	355e00183b3aea992959bd32db884770_exe32_JC.exe	28
PID 2684 wrote to memory of 1364	2684	355e00183b3aea992959bd32db884770_exe32_JC.exe	28
PID 2684 wrote to memory of 1364	2684	355e00183b3aea992959bd32db884770_exe32_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\355e00183b3aea992959bd32db884770_exe32_JC.exe
"C:\Users\Admin\AppData\Local\Temp\355e00183b3aea992959bd32db884770_exe32_JC.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\nyjhtyeuc\sqrneufah.exe
  "C:\Program Files (x86)\nyjhtyeuc\sqrneufah.exe"
  2⤵
  - Executes dropped EXE
  PID:1364

C:\Program Files (x86)\nyjhtyeuc\sqrneufah.exe

Filesize
1.1MB

MD5
d7dad8e9ba939f93fa822893215858d0

SHA1
98f589c015ba9d79be3094f39ca8957060113174

SHA256
85f581b0f50fe08c602e3e5a53e61e42b8ef7ca3980f04e24513bb9b492bce26

SHA512
75143776f72b38e71c499c0f00ed7eb4441b53c79b0f46407a9b698a2fdd00aa9ee68245bcfcf288f267105eb60ed963a0ae9ebb8e3562c71c9067cd1b220f60

Download Submit
\Program Files (x86)\nyjhtyeuc\sqrneufah.exe

Filesize
1.1MB

MD5
d7dad8e9ba939f93fa822893215858d0

SHA1
98f589c015ba9d79be3094f39ca8957060113174

SHA256
85f581b0f50fe08c602e3e5a53e61e42b8ef7ca3980f04e24513bb9b492bce26

SHA512
75143776f72b38e71c499c0f00ed7eb4441b53c79b0f46407a9b698a2fdd00aa9ee68245bcfcf288f267105eb60ed963a0ae9ebb8e3562c71c9067cd1b220f60

Download Submit
memory/1364-8-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1364-9-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1364-10-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2684-0-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2684-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2684-7-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download