2791f109f38b78027d4da9c003e109a0b8d50f826c839b9810af826f5af30513

Analysis

max time kernel
136s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:55

Target

0ad18396d13bb6fd0d4b36c2998b5e2d.exe
Size

60KB
MD5

0ad18396d13bb6fd0d4b36c2998b5e2d
SHA1

c5aaa26178c1567c801519aa89fa28dffc0a4710
SHA256

2791f109f38b78027d4da9c003e109a0b8d50f826c839b9810af826f5af30513
SHA512

cf0e752fac341a294ba0b0e677c6e788229a9fc86a6c185a7cb55eaaebf4725dd18d69b2edd6c50f7b9bd13ffa4702616ecbd89d3cc4a45a896f1e607ee52cc5
SSDEEP

768:CQMwdh60kcm8txtO9qFLIUJH/cIJ93/knEOqtHW6Z69F2O220z:CQVkc1rVzfoEOqZZ6iO220z

Score

7^/10

Deletes itself 1 IoCs

pid	Process
808	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2756	utktszap.exe

Loads dropped DLL 2 IoCs

pid	Process
2516	0ad18396d13bb6fd0d4b36c2998b5e2d.exe
2516	0ad18396d13bb6fd0d4b36c2998b5e2d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2516	0ad18396d13bb6fd0d4b36c2998b5e2d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2756	2516	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	31
PID 2516 wrote to memory of 2756	2516	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	31
PID 2516 wrote to memory of 2756	2516	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	31
PID 2516 wrote to memory of 2756	2516	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	31
PID 2516 wrote to memory of 808	2516	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	32
PID 2516 wrote to memory of 808	2516	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	32
PID 2516 wrote to memory of 808	2516	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	32
PID 2516 wrote to memory of 808	2516	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	32

C:\Users\Admin\AppData\Local\Temp\0ad18396d13bb6fd0d4b36c2998b5e2d.exe
"C:\Users\Admin\AppData\Local\Temp\0ad18396d13bb6fd0d4b36c2998b5e2d.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2516
- C:\ProgramData\ergjkjab\utktszap.exe
  C:\ProgramData\ergjkjab\utktszap.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\SysWOW64\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\0AD183~1.EXE.bak >> NUL
  2⤵
  - Deletes itself
  PID:808

\ProgramData\ergjkjab\utktszap.exe

Filesize
60KB

MD5
0ad18396d13bb6fd0d4b36c2998b5e2d

SHA1
c5aaa26178c1567c801519aa89fa28dffc0a4710

SHA256
2791f109f38b78027d4da9c003e109a0b8d50f826c839b9810af826f5af30513

SHA512
cf0e752fac341a294ba0b0e677c6e788229a9fc86a6c185a7cb55eaaebf4725dd18d69b2edd6c50f7b9bd13ffa4702616ecbd89d3cc4a45a896f1e607ee52cc5

Download Submit