4cecc8f93d5b9f7d4ccdd2268239491aae43f5c3e27e0d06a935e444c754ed8f

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 10:34

Target

0865ff08bba90bffef4e90f8f4d5a448.exe
Size

500KB
MD5

0865ff08bba90bffef4e90f8f4d5a448
SHA1

decc76beba9562f41af4e895f4538600d03ebf64
SHA256

4cecc8f93d5b9f7d4ccdd2268239491aae43f5c3e27e0d06a935e444c754ed8f
SHA512

1a4d3d75ab9643b9b4fc0f44b5fda78c314fbdd2c4c020eca6e4ebfaaa4d3843f9e43aaf4cddba2ab4e437237e022f262771d0b13a57f9e860ea21c814906af8
SSDEEP

6144:MTykDONo0jv7IoPfeq1ZzxRJbL7f5LAh36rSLL64r47FNJ8F0y7+1QpKLa2rO1s8:MLry/neyx7f/A64EBy7QQpYrO1s8

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2080	vkzh.exe

Loads dropped DLL 1 IoCs

pid	Process
2520	0865ff08bba90bffef4e90f8f4d5a448.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\sbliq\vkzh.exe	0865ff08bba90bffef4e90f8f4d5a448.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2080	2520	0865ff08bba90bffef4e90f8f4d5a448.exe	28
PID 2520 wrote to memory of 2080	2520	0865ff08bba90bffef4e90f8f4d5a448.exe	28
PID 2520 wrote to memory of 2080	2520	0865ff08bba90bffef4e90f8f4d5a448.exe	28
PID 2520 wrote to memory of 2080	2520	0865ff08bba90bffef4e90f8f4d5a448.exe	28

C:\Users\Admin\AppData\Local\Temp\0865ff08bba90bffef4e90f8f4d5a448.exe
"C:\Users\Admin\AppData\Local\Temp\0865ff08bba90bffef4e90f8f4d5a448.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\sbliq\vkzh.exe
  "C:\Program Files (x86)\sbliq\vkzh.exe"
  2⤵
  - Executes dropped EXE
  PID:2080

\Program Files (x86)\sbliq\vkzh.exe

Filesize
511KB

MD5
a3d33f9aee383a71deee1dacfdecd350

SHA1
702615f1962ade078c9802fcdc97a6c1a608e33a

SHA256
db068c02326b5bbb5fe4014fedcd469c689ee19c05563f5c4e7357d8f40711d0

SHA512
23e72d648ad4178d21cfb7afe17d48161217b21ee06fd710c848b1a3d18aa4cd087a6ee55eb005b238746c641ae6e4abd3a0891fc933468e9b608f1b4ba855b1

Download Submit
memory/2080-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2080-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2520-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2520-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2520-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download