e0cf0a26068ba5434e26b4b5257f4d3fc8957454628a0d16b8f27c2fdc35ec46

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 10:43

Target

0b3e8ffc9faf65b633e3e0112b45df89.exe
Size

607KB
MD5

0b3e8ffc9faf65b633e3e0112b45df89
SHA1

be1658916adc92cfcfe3cd0e876dbbc207249664
SHA256

e0cf0a26068ba5434e26b4b5257f4d3fc8957454628a0d16b8f27c2fdc35ec46
SHA512

b2d21b3a97b72f10aee9a989b4ba23d8ea36fdbecee2c1b52e3ed67eb356175d39e37344c62e6484d6a926cc023fc21b8547279418d1d2d5b424fbe79f7a68c8
SSDEEP

12288:MLry/neyx7f/A64iPs/9jZLp0bkMUWjWRZnDh:qKeyxTAJt9YeWjSnt

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2640	efqybjhvfahwx.exe

Loads dropped DLL 1 IoCs

pid	Process
2156	0b3e8ffc9faf65b633e3e0112b45df89.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\qqphcu\efqybjhvfahwx.exe	0b3e8ffc9faf65b633e3e0112b45df89.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2640	2156	0b3e8ffc9faf65b633e3e0112b45df89.exe	28
PID 2156 wrote to memory of 2640	2156	0b3e8ffc9faf65b633e3e0112b45df89.exe	28
PID 2156 wrote to memory of 2640	2156	0b3e8ffc9faf65b633e3e0112b45df89.exe	28
PID 2156 wrote to memory of 2640	2156	0b3e8ffc9faf65b633e3e0112b45df89.exe	28

C:\Users\Admin\AppData\Local\Temp\0b3e8ffc9faf65b633e3e0112b45df89.exe
"C:\Users\Admin\AppData\Local\Temp\0b3e8ffc9faf65b633e3e0112b45df89.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\qqphcu\efqybjhvfahwx.exe
  "C:\Program Files (x86)\qqphcu\efqybjhvfahwx.exe"
  2⤵
  - Executes dropped EXE
  PID:2640

\Program Files (x86)\qqphcu\efqybjhvfahwx.exe

Filesize
626KB

MD5
a8baa6d3f8a79bb0ce8d8ce9fbcc7232

SHA1
6cb33271d949fd5b46c25664561284418e09c93b

SHA256
b1e0f789a46deb5099b2b6a2ece689e7aab53e994c918142843691b68d1df1b4

SHA512
c7c175112f1d67cfb1949ab90e133f7c4d05689b68fb53c129b1f1bc1aa9f8e3721aa9b908580fccee2a83582903415e48de8e3d7b7f9ce69c3e620ca4f6fea5

Download Submit
memory/2156-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2156-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2156-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2640-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2640-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download