284b693dfdd12406826e29694479b85e2d7cc189784187da07b56f559e78999d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:29

Target

137194ecd53339111a561259151aa996.exe
Size

1.3MB
MD5

137194ecd53339111a561259151aa996
SHA1

992f962c6224fae6bc2422d56c717da84c5bf84a
SHA256

284b693dfdd12406826e29694479b85e2d7cc189784187da07b56f559e78999d
SHA512

6453142b90e6db2cfe41df9a17699714b00f6b898c34532ffb4db32618b1b2e6c4cefdf0f7f70115d30d6cb0551d525433c56338cd9df19af82d4732e94f4029
SSDEEP

24576:qKeyxTAJj7PZFK30B3I9ILWDdhV1uBKqu/PJCBrxF/1vvz6A6kw6:qKeyRAwEB3w7DbuBK18xF/1vvz6bq

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2960	xutsbcaq.exe

Loads dropped DLL 1 IoCs

pid	Process
2392	137194ecd53339111a561259151aa996.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\rfgn\xutsbcaq.exe	137194ecd53339111a561259151aa996.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2960	2392	137194ecd53339111a561259151aa996.exe	28
PID 2392 wrote to memory of 2960	2392	137194ecd53339111a561259151aa996.exe	28
PID 2392 wrote to memory of 2960	2392	137194ecd53339111a561259151aa996.exe	28
PID 2392 wrote to memory of 2960	2392	137194ecd53339111a561259151aa996.exe	28

C:\Users\Admin\AppData\Local\Temp\137194ecd53339111a561259151aa996.exe
"C:\Users\Admin\AppData\Local\Temp\137194ecd53339111a561259151aa996.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\rfgn\xutsbcaq.exe
  "C:\Program Files (x86)\rfgn\xutsbcaq.exe"
  2⤵
  - Executes dropped EXE
  PID:2960

\Program Files (x86)\rfgn\xutsbcaq.exe

Filesize
1.4MB

MD5
f0eff111637ce6b6eb61a6f90207fa80

SHA1
f6b0b7fd9afb5f3d72c093566b2f879810b00b2c

SHA256
dc27c3ec06e7a16ac123f324041f28ab25ed053ceb6a2525372ae7c573208058

SHA512
83381687c680bf6b2cdfaaf46fb39f827b1467e0760932fe7777fc81ba55a6f4578f9e35e9f6ecb746eefc6c1ebdf17abfadf3d0b325b569735d4eeda2dc8e72

Download Submit
memory/2392-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2392-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2392-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2960-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2960-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download