dec274c45f76a73a37d054c9ab07537e8ef5c6082782a874eb56b4a397e2ccc6

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 18:50

Target

00ef8c01edba099c8675d1f9a3aa60ca.exe
Size

936KB
MD5

00ef8c01edba099c8675d1f9a3aa60ca
SHA1

cbe326c6be08866f78dafb3c4e826c9e92b3d1ab
SHA256

dec274c45f76a73a37d054c9ab07537e8ef5c6082782a874eb56b4a397e2ccc6
SHA512

7d3629debb9a5e948926516dcf51e78a54e00c00ae6a05077aa1608422c54a3d588f4165c2162875c6f022e28fdb3208addaa788fa43ec08c9a3e118d005e04a
SSDEEP

12288:MLry/neyx7f/A64j7PYV3H/BxJsQYrFy698hi2hT4wgfP3xeb01jQwelN1U:qKeyxTAJj7PYJvYN9+i2Z4wWht5BM0

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1908	bmmgafeugst.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\irhg\bmmgafeugst.exe	00ef8c01edba099c8675d1f9a3aa60ca.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 1908	4180	00ef8c01edba099c8675d1f9a3aa60ca.exe	90
PID 4180 wrote to memory of 1908	4180	00ef8c01edba099c8675d1f9a3aa60ca.exe	90
PID 4180 wrote to memory of 1908	4180	00ef8c01edba099c8675d1f9a3aa60ca.exe	90

C:\Users\Admin\AppData\Local\Temp\00ef8c01edba099c8675d1f9a3aa60ca.exe
"C:\Users\Admin\AppData\Local\Temp\00ef8c01edba099c8675d1f9a3aa60ca.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Program Files (x86)\irhg\bmmgafeugst.exe
  "C:\Program Files (x86)\irhg\bmmgafeugst.exe"
  2⤵
  - Executes dropped EXE
  PID:1908

C:\Program Files (x86)\irhg\bmmgafeugst.exe

Filesize
961KB

MD5
8f098d9b5112d5a07afcc1c7cbc9f1e8

SHA1
77fa279d3758192a50be7104f47f1adf1762c940

SHA256
a58f16487b6628e21b64e80d0a1488ee9d0bd2859197926f76d506d5585676ed

SHA512
58cf5f0d1e3e5542f117f782969c690e9d7100c1f705cfdd0faaea89d7dc260dd9d1ada64c77d18001edd64a6c0bffcc6e55b0af05253ac2b6044731d4f819d7

Download Submit
C:\Program Files (x86)\irhg\bmmgafeugst.exe

Filesize
65KB

MD5
a94bf6a33aa2bc9cfe4db168e6e4dbab

SHA1
6a0f77decb9b3d92507dd730df80b3d432fa2288

SHA256
aaad2022905535cd9769c42496229c23c2648754593055092d0259c46e585c59

SHA512
3a72145292182109c457f69414b145ac1e818ca3b730d97dbaede757d2e41a41cd1b949217012b75fc06529f497c868867153fd921dd3338bf130d0d0f6a865f

Download Submit
memory/1908-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1908-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4180-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4180-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4180-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download