4cecc8f93d5b9f7d4ccdd2268239491aae43f5c3e27e0d06a935e444c754ed8f

Analysis

max time kernel
93s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 10:34

Target

0865ff08bba90bffef4e90f8f4d5a448.exe
Size

500KB
MD5

0865ff08bba90bffef4e90f8f4d5a448
SHA1

decc76beba9562f41af4e895f4538600d03ebf64
SHA256

4cecc8f93d5b9f7d4ccdd2268239491aae43f5c3e27e0d06a935e444c754ed8f
SHA512

1a4d3d75ab9643b9b4fc0f44b5fda78c314fbdd2c4c020eca6e4ebfaaa4d3843f9e43aaf4cddba2ab4e437237e022f262771d0b13a57f9e860ea21c814906af8
SSDEEP

6144:MTykDONo0jv7IoPfeq1ZzxRJbL7f5LAh36rSLL64r47FNJ8F0y7+1QpKLa2rO1s8:MLry/neyx7f/A64EBy7QQpYrO1s8

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3188	mdiufpgtx.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\fcqrpzl\mdiufpgtx.exe	0865ff08bba90bffef4e90f8f4d5a448.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 3188	3944	0865ff08bba90bffef4e90f8f4d5a448.exe	88
PID 3944 wrote to memory of 3188	3944	0865ff08bba90bffef4e90f8f4d5a448.exe	88
PID 3944 wrote to memory of 3188	3944	0865ff08bba90bffef4e90f8f4d5a448.exe	88

C:\Users\Admin\AppData\Local\Temp\0865ff08bba90bffef4e90f8f4d5a448.exe
"C:\Users\Admin\AppData\Local\Temp\0865ff08bba90bffef4e90f8f4d5a448.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Program Files (x86)\fcqrpzl\mdiufpgtx.exe
  "C:\Program Files (x86)\fcqrpzl\mdiufpgtx.exe"
  2⤵
  - Executes dropped EXE
  PID:3188

C:\Program Files (x86)\fcqrpzl\mdiufpgtx.exe

Filesize
513KB

MD5
f97840c52339a7bceea66df4d4267189

SHA1
d87e0637c760c71be5f86bf9d4eddfed8873fb4a

SHA256
ddb85e32ee0281633f8a1cb69ff2903050ba76ca60d44fd02176464b51b3c225

SHA512
75547d34ab822b09f5a1a6b483ad4f3ea2b778ef5f505f88446fd6951746ef359d7e113e93875a4644d1185d68e23db9782a15900fdb64608a6df7063f925003

Download Submit
memory/3188-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3188-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3944-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3944-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3944-4-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download