090d879dba019310bc6866ff848447fe7567557ca4586c64fa8b7d79adbd1b0d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 05:32

Target

577fad3e53e76238c2fcc8d7106cba06.exe
Size

779KB
MD5

577fad3e53e76238c2fcc8d7106cba06
SHA1

dc19d9f4f278c4f13fe6cc6ebe39bb3a3e995070
SHA256

090d879dba019310bc6866ff848447fe7567557ca4586c64fa8b7d79adbd1b0d
SHA512

edc297a1717fa2785524051ded46741ea22a20d8303bbd533c061d03d3906d9048ac07c827aa74171ae1e6a324c66c7b5435f89a5b9bb23846627195e46021cd
SSDEEP

24576:7zXKqa8SEijjC+37li4daoInr1YSfi6HfRG7T2OuGjMi0CY38:7z6qaakjC+3s4da1nHzfKDbY38

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2032	qds.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\grwyehqm\qds.exe	577fad3e53e76238c2fcc8d7106cba06.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2032	2292	577fad3e53e76238c2fcc8d7106cba06.exe	19
PID 2292 wrote to memory of 2032	2292	577fad3e53e76238c2fcc8d7106cba06.exe	19
PID 2292 wrote to memory of 2032	2292	577fad3e53e76238c2fcc8d7106cba06.exe	19

C:\Users\Admin\AppData\Local\Temp\577fad3e53e76238c2fcc8d7106cba06.exe
"C:\Users\Admin\AppData\Local\Temp\577fad3e53e76238c2fcc8d7106cba06.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\grwyehqm\qds.exe
  "C:\Program Files (x86)\grwyehqm\qds.exe"
  2⤵
  - Executes dropped EXE
  PID:2032

C:\Program Files (x86)\grwyehqm\qds.exe

Filesize
92KB

MD5
db281d63f67a501e777ff46d7ce7a77b

SHA1
622db3f10ca287f0710e1fb837cf946bf5e74005

SHA256
c8b2e47b5cb7bd2bc752843bcf44a1cb449989de98ba63b2dbee908a832a9c8c

SHA512
75a144659a5959e39be098a850c7613ffdedfcbcd145fbca4b1cc98dda79bfc994ad413b684aff0dc54648fab92bd5196bd4369cdb7d2053a938af870f55ffc2

Download Submit
memory/2032-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2032-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2292-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2292-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2292-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download