a4de817b17c74b004874e1390ec5d65dda40800a4d759ac7ce37272deb4f36c0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:43

Target

12760504284c7512b2f603f5ed53ccd0.exe
Size

870KB
MD5

12760504284c7512b2f603f5ed53ccd0
SHA1

2c47fc5cc74173efb6fec14a028c1d0df664b596
SHA256

a4de817b17c74b004874e1390ec5d65dda40800a4d759ac7ce37272deb4f36c0
SHA512

cd1415d95762502252076d5ae6164da735baf60011831b6b032aa0e79ddb9dd8dc6dbf3990117ca676d794c534ecc0f8f519412b2c692b1abec936bb76991fcd
SSDEEP

24576:qKeyxTAJj7P+yW6mc1YVJCloh3JZCPHLWlC1gP:qKeyRA0y9fWVJA0Mf6la4

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2372	vxwsexmyrsl.exe

Loads dropped DLL 1 IoCs

pid	Process
1684	12760504284c7512b2f603f5ed53ccd0.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\cptpcxchj\vxwsexmyrsl.exe	12760504284c7512b2f603f5ed53ccd0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2372	1684	12760504284c7512b2f603f5ed53ccd0.exe	16
PID 1684 wrote to memory of 2372	1684	12760504284c7512b2f603f5ed53ccd0.exe	16
PID 1684 wrote to memory of 2372	1684	12760504284c7512b2f603f5ed53ccd0.exe	16
PID 1684 wrote to memory of 2372	1684	12760504284c7512b2f603f5ed53ccd0.exe	16

C:\Users\Admin\AppData\Local\Temp\12760504284c7512b2f603f5ed53ccd0.exe
"C:\Users\Admin\AppData\Local\Temp\12760504284c7512b2f603f5ed53ccd0.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\cptpcxchj\vxwsexmyrsl.exe
  "C:\Program Files (x86)\cptpcxchj\vxwsexmyrsl.exe"
  2⤵
  - Executes dropped EXE
  PID:2372

memory/1684-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1684-7-0x00000000002E0000-0x0000000000374000-memory.dmp

Filesize
592KB

Download
memory/1684-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1684-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1684-11-0x00000000002E0000-0x0000000000374000-memory.dmp

Filesize
592KB

Download
memory/2372-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2372-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download