35ada52905e3729f1dc06a72d0d3ab786a926e6be7cba1e657ece397f4ec7e73

Analysis

max time kernel
150s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 09:57

Target

65721a35328c5417e690f8df878eb475.exe
Size

402KB
MD5

65721a35328c5417e690f8df878eb475
SHA1

03462f95f46183f40befe6fdeeddd34fbf5ec8d7
SHA256

35ada52905e3729f1dc06a72d0d3ab786a926e6be7cba1e657ece397f4ec7e73
SHA512

db727a56860cd032236d1e8c8b52dcdf5538b1d0d85a314f4e59393b4d6c4e32ea13c0535733c02476ee25eb4b092f2436f203d8933dddfa5b49ce61a7deebdc
SSDEEP

6144:MTykDONo0jv7IoPfeq1ZzxRJbL7f5LAh36rSLL64j7W4SPHREuLNeCrS:MLry/neyx7f/A64j7PSfRgCrS

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2084	qyffxmbswwjpg.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\oxddynlf\qyffxmbswwjpg.exe	65721a35328c5417e690f8df878eb475.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 2084	660	65721a35328c5417e690f8df878eb475.exe	91
PID 660 wrote to memory of 2084	660	65721a35328c5417e690f8df878eb475.exe	91
PID 660 wrote to memory of 2084	660	65721a35328c5417e690f8df878eb475.exe	91

C:\Users\Admin\AppData\Local\Temp\65721a35328c5417e690f8df878eb475.exe
"C:\Users\Admin\AppData\Local\Temp\65721a35328c5417e690f8df878eb475.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:660
- C:\Program Files (x86)\oxddynlf\qyffxmbswwjpg.exe
  "C:\Program Files (x86)\oxddynlf\qyffxmbswwjpg.exe"
  2⤵
  - Executes dropped EXE
  PID:2084

C:\Program Files (x86)\oxddynlf\qyffxmbswwjpg.exe

Filesize
427KB

MD5
cf3755c58fe461759e19b16b03388152

SHA1
b3f0587a366ba8f758f21e6d7c6fdbaf4190cf68

SHA256
f7a73bcd649a8e4dc00a7c45e9b4f43c251ca61eae14fee5e19a706514d20e5a

SHA512
7602adc14eeaed093ae26fdb1ae4a8060939e25bed84d09a9704323a2941219726cbadfffc805ddb00b39c6487cbdb748957e43f190d8c0808ad41d75e202d30

Download Submit
memory/660-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/660-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/660-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2084-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2084-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download