5b1450cff61be58dc14b63f1c3e26ed33cbc8a387c603c5be34e38f3d4275c02

Analysis

max time kernel
105s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 19:35

Target

355e00183b3aea992959bd32db884770_exe32_JC.exe
Size

1.1MB
MD5

355e00183b3aea992959bd32db884770
SHA1

647e16720e9a409943899add01c7b2c955821618
SHA256

5b1450cff61be58dc14b63f1c3e26ed33cbc8a387c603c5be34e38f3d4275c02
SHA512

76cbd64e6f8d6f3ebe3ca65ef37a1f7fd66f0e13b55c90457fbf5e877dab98a939a865e51dc7b77cac1a97f33c3b3501b03794c133cdb6e0a137466a26db69d9
SSDEEP

24576:8BJhlR9YTMJjG2oE8xk2ZFquG6OPWCcCBfAKyv9hGYkNruNBWS95:8BJJPJjG2onxk2/zG6rCtM9Q/gBZX

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2280	qjsgdnykf.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\rddhzkpw\qjsgdnykf.exe	355e00183b3aea992959bd32db884770_exe32_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2280	2228	355e00183b3aea992959bd32db884770_exe32_JC.exe	80
PID 2228 wrote to memory of 2280	2228	355e00183b3aea992959bd32db884770_exe32_JC.exe	80
PID 2228 wrote to memory of 2280	2228	355e00183b3aea992959bd32db884770_exe32_JC.exe	80

C:\Users\Admin\AppData\Local\Temp\355e00183b3aea992959bd32db884770_exe32_JC.exe
"C:\Users\Admin\AppData\Local\Temp\355e00183b3aea992959bd32db884770_exe32_JC.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\rddhzkpw\qjsgdnykf.exe
  "C:\Program Files (x86)\rddhzkpw\qjsgdnykf.exe"
  2⤵
  - Executes dropped EXE
  PID:2280

C:\Program Files (x86)\rddhzkpw\qjsgdnykf.exe

Filesize
1.1MB

MD5
02e1655a8e0f53399389447818dd83d2

SHA1
9f3a8015f1079a4e3d6dafc7747954269e8415ea

SHA256
9fb2eebfc22c22d30e95541c27aa1264c8d5212eebadf0ec79e6c8af015c445f

SHA512
5f0b8e3f0ca385badc60d08eefe806d173d6c30ecc5e37eac8880b090d9e454b1de6f19599f17390c93b03908637487b4129bca0b6f5faf559d2f47d6fc8a3b7

Download Submit
C:\Program Files (x86)\rddhzkpw\qjsgdnykf.exe

Filesize
1.1MB

MD5
02e1655a8e0f53399389447818dd83d2

SHA1
9f3a8015f1079a4e3d6dafc7747954269e8415ea

SHA256
9fb2eebfc22c22d30e95541c27aa1264c8d5212eebadf0ec79e6c8af015c445f

SHA512
5f0b8e3f0ca385badc60d08eefe806d173d6c30ecc5e37eac8880b090d9e454b1de6f19599f17390c93b03908637487b4129bca0b6f5faf559d2f47d6fc8a3b7

Download Submit
memory/2228-0-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2228-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2228-6-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2280-7-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2280-8-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download