725b6df7934f8e1f7503766960a763653f02209d135b3728f89f243dcbf9ccbf

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 02:53

Target

56f34b3ab700e04ec7c3e8c7bc78dd3d.exe
Size

987KB
MD5

56f34b3ab700e04ec7c3e8c7bc78dd3d
SHA1

fc45745fe582d9229354855686bb05156b1d4bba
SHA256

725b6df7934f8e1f7503766960a763653f02209d135b3728f89f243dcbf9ccbf
SHA512

1118f937bcbeece8f6eb738af6331c3eea37736b40061f7e64198ea0781ba4e939b91ebff8083d578b4575e93707cd70c9659ca7ae592830902f66e0e17c58b0
SSDEEP

24576:dgdhhQGGniba/WPpuvlBEaneHueYQFSMVNS/:dqj5s8+elYQFSM7u

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1796	vpb.exe

Loads dropped DLL 1 IoCs

pid	Process
1948	56f34b3ab700e04ec7c3e8c7bc78dd3d.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\utsiawm\vpb.exe	56f34b3ab700e04ec7c3e8c7bc78dd3d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1796	1948	56f34b3ab700e04ec7c3e8c7bc78dd3d.exe	28
PID 1948 wrote to memory of 1796	1948	56f34b3ab700e04ec7c3e8c7bc78dd3d.exe	28
PID 1948 wrote to memory of 1796	1948	56f34b3ab700e04ec7c3e8c7bc78dd3d.exe	28
PID 1948 wrote to memory of 1796	1948	56f34b3ab700e04ec7c3e8c7bc78dd3d.exe	28

C:\Users\Admin\AppData\Local\Temp\56f34b3ab700e04ec7c3e8c7bc78dd3d.exe
"C:\Users\Admin\AppData\Local\Temp\56f34b3ab700e04ec7c3e8c7bc78dd3d.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\utsiawm\vpb.exe
  "C:\Program Files (x86)\utsiawm\vpb.exe"
  2⤵
  - Executes dropped EXE
  PID:1796

\Program Files (x86)\utsiawm\vpb.exe

Filesize
999KB

MD5
a30dafd9850bca6816617a75f1a7ecc1

SHA1
3885166318dcec81992686775828c30c95ed374e

SHA256
c3c568038a45a3ae50f1f736d116ec14a2ebfb40b22682629ef8438ddf3d6a78

SHA512
cb932102ad0f374206dd6a41ff77949d3ab0d30fd0f2fdb137c9beedcbdd4c3abe507a1a150ed938909709d54fce8c010d7b1564844f9e652a6c798869f73bc0

Download Submit
memory/1796-6-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1948-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download