5d17d24f98ba5a9e9721f7ddd125c596aa043e88153b7a8483635fd23c4b67a4

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:34

Target

1242f0085d300bbc7f1d81d54f0c00b2.exe
Size

961KB
MD5

1242f0085d300bbc7f1d81d54f0c00b2
SHA1

a263ed831df976ff606e751da57a3ebad6381978
SHA256

5d17d24f98ba5a9e9721f7ddd125c596aa043e88153b7a8483635fd23c4b67a4
SHA512

164cdbdfaf574445ce783e27a6480bd5124b0f1454f8c373ddb9269cfe65a3f28d73d0aae43fa629576d88eafcca3baf40cfa37c5ccea71bfe25376ca0c6cc3e
SSDEEP

24576:7zXKqa8SEijjC+37u9BEqxt5VUsftMQtadUj/DaxOiPKU:7z6qaakjC+3aNxJU2XtadsuYQ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2356	exhgnditego.exe

Loads dropped DLL 1 IoCs

pid	Process
1088	1242f0085d300bbc7f1d81d54f0c00b2.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\fgjw\exhgnditego.exe	1242f0085d300bbc7f1d81d54f0c00b2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2356	1088	1242f0085d300bbc7f1d81d54f0c00b2.exe	16
PID 1088 wrote to memory of 2356	1088	1242f0085d300bbc7f1d81d54f0c00b2.exe	16
PID 1088 wrote to memory of 2356	1088	1242f0085d300bbc7f1d81d54f0c00b2.exe	16
PID 1088 wrote to memory of 2356	1088	1242f0085d300bbc7f1d81d54f0c00b2.exe	16

C:\Users\Admin\AppData\Local\Temp\1242f0085d300bbc7f1d81d54f0c00b2.exe
"C:\Users\Admin\AppData\Local\Temp\1242f0085d300bbc7f1d81d54f0c00b2.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\fgjw\exhgnditego.exe
  "C:\Program Files (x86)\fgjw\exhgnditego.exe"
  2⤵
  - Executes dropped EXE
  PID:2356

memory/1088-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1088-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1088-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2356-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2356-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download