b3766bf2e2c92774e4ce29cf14f260583d8604065204c6d755a5d942a8e87f1b

Analysis

max time kernel
95s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 20:14

Target

3a9f072f55b3c9a0008915b28790b507.exe
Size

361KB
MD5

3a9f072f55b3c9a0008915b28790b507
SHA1

f2c6068e6f30d22cb0ff74c58643b2e51e468b01
SHA256

b3766bf2e2c92774e4ce29cf14f260583d8604065204c6d755a5d942a8e87f1b
SHA512

fc6df10769b15dff0e01dbe02d3852a4415bb5f055953121a2e1b7bbc8907ed75335cacf70a2fbf28b67a7a3a6fe4f8915a09ddaa894d4a8f75a600b8b21406a
SSDEEP

6144:MTykDONo0jv7IoPfeq1ZzxRJbL7f5LAh36rSLL64j7W4+yQrOx5YsRC:MLry/neyx7f/A64j7P+tixhRC

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3476	vbyhppvdp.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\tnfue\vbyhppvdp.exe	3a9f072f55b3c9a0008915b28790b507.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3476	4444	3a9f072f55b3c9a0008915b28790b507.exe	90
PID 4444 wrote to memory of 3476	4444	3a9f072f55b3c9a0008915b28790b507.exe	90
PID 4444 wrote to memory of 3476	4444	3a9f072f55b3c9a0008915b28790b507.exe	90

C:\Users\Admin\AppData\Local\Temp\3a9f072f55b3c9a0008915b28790b507.exe
"C:\Users\Admin\AppData\Local\Temp\3a9f072f55b3c9a0008915b28790b507.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files (x86)\tnfue\vbyhppvdp.exe
  "C:\Program Files (x86)\tnfue\vbyhppvdp.exe"
  2⤵
  - Executes dropped EXE
  PID:3476

C:\Program Files (x86)\tnfue\vbyhppvdp.exe

Filesize
380KB

MD5
1f5fcfeaa01b19682520f7eaf67e5d1f

SHA1
41f3beac77388594918ae5d298ddc82921606e7f

SHA256
2dfeb3a4de326c4ec747109e2035ff76a4ed51ee60421854680f97d8f2cf133d

SHA512
227cd8a861369a1f279465468af80bc2289e6084a885c9138f8bcd036c00e776db0771cd95e1e9fd6a715840152b76f7956c7dfbca9f869843c67820594cf0f4

Download Submit
memory/3476-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3476-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4444-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4444-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4444-5-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download