a4de817b17c74b004874e1390ec5d65dda40800a4d759ac7ce37272deb4f36c0

Analysis

max time kernel
147s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 07:43

Target

12760504284c7512b2f603f5ed53ccd0.exe
Size

870KB
MD5

12760504284c7512b2f603f5ed53ccd0
SHA1

2c47fc5cc74173efb6fec14a028c1d0df664b596
SHA256

a4de817b17c74b004874e1390ec5d65dda40800a4d759ac7ce37272deb4f36c0
SHA512

cd1415d95762502252076d5ae6164da735baf60011831b6b032aa0e79ddb9dd8dc6dbf3990117ca676d794c534ecc0f8f519412b2c692b1abec936bb76991fcd
SSDEEP

24576:qKeyxTAJj7P+yW6mc1YVJCloh3JZCPHLWlC1gP:qKeyRA0y9fWVJA0Mf6la4

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4144	tuzmlulapugo.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\zozb\tuzmlulapugo.exe	12760504284c7512b2f603f5ed53ccd0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4144	4032	12760504284c7512b2f603f5ed53ccd0.exe	20
PID 4032 wrote to memory of 4144	4032	12760504284c7512b2f603f5ed53ccd0.exe	20
PID 4032 wrote to memory of 4144	4032	12760504284c7512b2f603f5ed53ccd0.exe	20

C:\Users\Admin\AppData\Local\Temp\12760504284c7512b2f603f5ed53ccd0.exe
"C:\Users\Admin\AppData\Local\Temp\12760504284c7512b2f603f5ed53ccd0.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files (x86)\zozb\tuzmlulapugo.exe
  "C:\Program Files (x86)\zozb\tuzmlulapugo.exe"
  2⤵
  - Executes dropped EXE
  PID:4144

C:\Program Files (x86)\zozb\tuzmlulapugo.exe

Filesize
92KB

MD5
c310109d4c61065328bc6a8a48bcf3b8

SHA1
f1212969e0678c3519ab5b8c1fdd1b25b1168de0

SHA256
92ec6f54d7e69b86d27f113c2985dc2066e905aa9c902e0d82f2e1c885e09764

SHA512
760503e21cbbd76024bf5674ca770132afedff7c5b369d1bad91d6eac19174b1c9328a1e6566b3efae23013ce0512f03d6495291b594056ea26e614231a5f30d

Download Submit
memory/4032-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4032-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4032-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4144-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4144-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download