2c05573f52b2d86226e7b162da397e2bb05b65f220d29898fe9015d0d3f0a77a

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:52

Target

079fc54e48dda546687aef93108d4302.exe
Size

1.7MB
MD5

079fc54e48dda546687aef93108d4302
SHA1

bcc26d92547904fc3737eb92ac100f9252df7ee6
SHA256

2c05573f52b2d86226e7b162da397e2bb05b65f220d29898fe9015d0d3f0a77a
SHA512

3301b7db8d596db6531c25a1932f6851a388499cd4cb06e2a2b997f8180484de4203d8911622b5235b2b29c6c2ac75bb6b074def17e4c50178ce19720ac4f9cb
SSDEEP

24576:dgdhhQGGnnazLpj4VHogiuGYNycAavew3mwmI1nk30sKbcGOyRW9ZHXE:dqgazxcGYN139lnk30rT

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1500	ynxnerthrd.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\wawhztf\ynxnerthrd.exe	079fc54e48dda546687aef93108d4302.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1500	2888	079fc54e48dda546687aef93108d4302.exe	92
PID 2888 wrote to memory of 1500	2888	079fc54e48dda546687aef93108d4302.exe	92
PID 2888 wrote to memory of 1500	2888	079fc54e48dda546687aef93108d4302.exe	92

C:\Users\Admin\AppData\Local\Temp\079fc54e48dda546687aef93108d4302.exe
"C:\Users\Admin\AppData\Local\Temp\079fc54e48dda546687aef93108d4302.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\wawhztf\ynxnerthrd.exe
  "C:\Program Files (x86)\wawhztf\ynxnerthrd.exe"
  2⤵
  - Executes dropped EXE
  PID:1500

C:\Program Files (x86)\wawhztf\ynxnerthrd.exe

Filesize
358KB

MD5
e9a3a9c9ee3560cfc1b89e91a6439af8

SHA1
54d5c2119fcd1756395097cec6ccf5a956a4f5fa

SHA256
76a6b701e94d156caaefe9d218c7e4ee34beb3b5fbe06ba462b98329e2829b11

SHA512
4f60be644d35e20841ea4107b8af79dda49a1058b5fb791029c4a8ddd387ecf96dabaa7e70a90ef1b424c9dcd720377a1614d14661ed159bc982e4c5ad833a5a

Download Submit
C:\Program Files (x86)\wawhztf\ynxnerthrd.exe

Filesize
394KB

MD5
2783eaabfcaba33b8005d3a93c92a3ca

SHA1
ec83e4439aecadf6d834a11b168c1df130beb702

SHA256
5bfcfd7c8a5ce4c51967cd30f40e76e37f4ed143154f1617482fb580c3b0c0c8

SHA512
fe6c9422e9ffad39fe3cfbdd8f23937d29dca4b3ddf64a6369d2b0aef118712ea17a593c22fd9e5d3a80549caa9a04cebd1d16d52710cf7f7753446d2fd3130a

Download Submit
memory/1500-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2888-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download