b3766bf2e2c92774e4ce29cf14f260583d8604065204c6d755a5d942a8e87f1b

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:14

Target

3a9f072f55b3c9a0008915b28790b507.exe
Size

361KB
MD5

3a9f072f55b3c9a0008915b28790b507
SHA1

f2c6068e6f30d22cb0ff74c58643b2e51e468b01
SHA256

b3766bf2e2c92774e4ce29cf14f260583d8604065204c6d755a5d942a8e87f1b
SHA512

fc6df10769b15dff0e01dbe02d3852a4415bb5f055953121a2e1b7bbc8907ed75335cacf70a2fbf28b67a7a3a6fe4f8915a09ddaa894d4a8f75a600b8b21406a
SSDEEP

6144:MTykDONo0jv7IoPfeq1ZzxRJbL7f5LAh36rSLL64j7W4+yQrOx5YsRC:MLry/neyx7f/A64j7P+tixhRC

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2716	wplczos.exe

Loads dropped DLL 1 IoCs

pid	Process
2668	3a9f072f55b3c9a0008915b28790b507.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\rosykatvge\wplczos.exe	3a9f072f55b3c9a0008915b28790b507.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2716	2668	3a9f072f55b3c9a0008915b28790b507.exe	28
PID 2668 wrote to memory of 2716	2668	3a9f072f55b3c9a0008915b28790b507.exe	28
PID 2668 wrote to memory of 2716	2668	3a9f072f55b3c9a0008915b28790b507.exe	28
PID 2668 wrote to memory of 2716	2668	3a9f072f55b3c9a0008915b28790b507.exe	28

C:\Users\Admin\AppData\Local\Temp\3a9f072f55b3c9a0008915b28790b507.exe
"C:\Users\Admin\AppData\Local\Temp\3a9f072f55b3c9a0008915b28790b507.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\rosykatvge\wplczos.exe
  "C:\Program Files (x86)\rosykatvge\wplczos.exe"
  2⤵
  - Executes dropped EXE
  PID:2716

\Program Files (x86)\rosykatvge\wplczos.exe

Filesize
385KB

MD5
79bf46829ac7e532e29463ed5e1fe5a0

SHA1
8101e1d16f360094d83d39ae35e2cae59e3914c9

SHA256
546d983db78488d2897a2f2d35f466fa5b616bb3bdbbafa8fe49af5ee1852324

SHA512
3c26a1178c9c7273073b90d39ddbc8172201b29375c894a2927a4aa69f12a24f04f6bad952976dba28f62091ffcf560a6e2c46c7701d002c9de176d430f1a214

Download Submit
memory/2668-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2668-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2668-5-0x0000000001D30000-0x0000000001DC4000-memory.dmp

Filesize
592KB

Download
memory/2668-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2716-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2716-11-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download