725b6df7934f8e1f7503766960a763653f02209d135b3728f89f243dcbf9ccbf

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 02:53

Target

56f34b3ab700e04ec7c3e8c7bc78dd3d.exe
Size

987KB
MD5

56f34b3ab700e04ec7c3e8c7bc78dd3d
SHA1

fc45745fe582d9229354855686bb05156b1d4bba
SHA256

725b6df7934f8e1f7503766960a763653f02209d135b3728f89f243dcbf9ccbf
SHA512

1118f937bcbeece8f6eb738af6331c3eea37736b40061f7e64198ea0781ba4e939b91ebff8083d578b4575e93707cd70c9659ca7ae592830902f66e0e17c58b0
SSDEEP

24576:dgdhhQGGniba/WPpuvlBEaneHueYQFSMVNS/:dqj5s8+elYQFSM7u

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4896	oweavoibas.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ksl\oweavoibas.exe	56f34b3ab700e04ec7c3e8c7bc78dd3d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4896	3408	56f34b3ab700e04ec7c3e8c7bc78dd3d.exe	90
PID 3408 wrote to memory of 4896	3408	56f34b3ab700e04ec7c3e8c7bc78dd3d.exe	90
PID 3408 wrote to memory of 4896	3408	56f34b3ab700e04ec7c3e8c7bc78dd3d.exe	90

C:\Users\Admin\AppData\Local\Temp\56f34b3ab700e04ec7c3e8c7bc78dd3d.exe
"C:\Users\Admin\AppData\Local\Temp\56f34b3ab700e04ec7c3e8c7bc78dd3d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files (x86)\ksl\oweavoibas.exe
  "C:\Program Files (x86)\ksl\oweavoibas.exe"
  2⤵
  - Executes dropped EXE
  PID:4896

C:\Program Files (x86)\ksl\oweavoibas.exe

Filesize
996KB

MD5
6d562ba3aeb832fce91ae7c9e587c920

SHA1
ff190f82ecc657c90910031c635559f031cece36

SHA256
29a0ad39da6a28af9ef48a964dc3f8cd86ad5259719d6cf07aa45c68abee8142

SHA512
2ab71a28cd1f9ee8b13e03828e41e14edff76477e1b8a4d72952940353cb9c0d82e713c93ce68a1fa216da3cc0247afb9e374f76a006e48637522195a230e1aa

Download Submit
memory/3408-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4896-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download