ddf4c10ea46e5f21c7f38527c3aa47ce519576a669d9cbeb15500ad691da931f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 15:52

Target

54ea80e445f72c4ce2c8f184ac781055.exe
Size

971KB
MD5

54ea80e445f72c4ce2c8f184ac781055
SHA1

92caa7e44c0d6d4359fb6dacf8d4de4812ee5f65
SHA256

ddf4c10ea46e5f21c7f38527c3aa47ce519576a669d9cbeb15500ad691da931f
SHA512

cd124719f30ad178e978d0c28bcccba1ea704e744ee2a28e672b5219ef8180d8fd2a8cc30b0d7e8d81c3e008f597ca668f75cbd8d016f94c2a6f39440d132e3d
SSDEEP

24576:dgdhhQGGnnazLpj4VHogiuG1rnIAypJqtP:dqgazxcG1DKqtP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2256	yym.exe

Loads dropped DLL 1 IoCs

pid	Process
2020	54ea80e445f72c4ce2c8f184ac781055.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\whusllka\yym.exe	54ea80e445f72c4ce2c8f184ac781055.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2256	2020	54ea80e445f72c4ce2c8f184ac781055.exe	28
PID 2020 wrote to memory of 2256	2020	54ea80e445f72c4ce2c8f184ac781055.exe	28
PID 2020 wrote to memory of 2256	2020	54ea80e445f72c4ce2c8f184ac781055.exe	28
PID 2020 wrote to memory of 2256	2020	54ea80e445f72c4ce2c8f184ac781055.exe	28

C:\Users\Admin\AppData\Local\Temp\54ea80e445f72c4ce2c8f184ac781055.exe
"C:\Users\Admin\AppData\Local\Temp\54ea80e445f72c4ce2c8f184ac781055.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\whusllka\yym.exe
  "C:\Program Files (x86)\whusllka\yym.exe"
  2⤵
  - Executes dropped EXE
  PID:2256

\Program Files (x86)\whusllka\yym.exe

Filesize
983KB

MD5
b8d0548dc9d517ed710d3f968bc6214b

SHA1
d7f154ac1553eb73e5218046eeb520e6818c97a0

SHA256
6c4753114fd1021c6b6c74b6cf95bd0c255574960eb770facdd38dd102f92a5c

SHA512
c7b720e77773cb60ea2035cca3ef4ad90613750d6002ddf1f08d56b1114e29173a99895a7585a7bbb528383114fad8c40bfcea792ce362341a991793f246f0e7

Download Submit
memory/2020-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2256-6-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download