6558ac3891d248cc0435d9d6a8c2f2c0a8b608adbb3fa30641ab4fd34f61be03

Analysis

max time kernel
175s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 09:22

Target

145be25bec2698cc5dee13b8c66ecf99.exe
Size

962KB
MD5

145be25bec2698cc5dee13b8c66ecf99
SHA1

b9e5991cb5560a3222f7c63fb0de7bb87d9973ea
SHA256

6558ac3891d248cc0435d9d6a8c2f2c0a8b608adbb3fa30641ab4fd34f61be03
SHA512

a92eeedc7e805aa3e71d6c58e3a460dc842c90742ff2e2c1dfb54ec184760aede269e67741b2eea8dc6704289f3915b9bb6a96ca5a718229a6e2d2a5094783de
SSDEEP

24576:qKeyxTAJj7PZFK30B3I9ILWDdhVL0OOsImM/UqM8fi:qKeyRAwEB3w7DOZmmUqBfi

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4944	eonucjx.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\tzypjoa\eonucjx.exe	145be25bec2698cc5dee13b8c66ecf99.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4944	4700	145be25bec2698cc5dee13b8c66ecf99.exe	92
PID 4700 wrote to memory of 4944	4700	145be25bec2698cc5dee13b8c66ecf99.exe	92
PID 4700 wrote to memory of 4944	4700	145be25bec2698cc5dee13b8c66ecf99.exe	92

C:\Users\Admin\AppData\Local\Temp\145be25bec2698cc5dee13b8c66ecf99.exe
"C:\Users\Admin\AppData\Local\Temp\145be25bec2698cc5dee13b8c66ecf99.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\tzypjoa\eonucjx.exe
  "C:\Program Files (x86)\tzypjoa\eonucjx.exe"
  2⤵
  - Executes dropped EXE
  PID:4944

C:\Program Files (x86)\tzypjoa\eonucjx.exe

Filesize
978KB

MD5
25d4a9a8c48d2f6da002bd25e2dfb5ff

SHA1
fe7a3758570cb4006651301f1fea0cded88797e0

SHA256
1c825ab60fb4ad10e402be43cb61b5360c9f3d8491261f7b96db446faaec08e8

SHA512
91d4484a983cc4f84b031a52ac360da1c6c32222a4cc881de62c17e36a521b62d9cb9f3bbb9c0458a2c439c557b34650ee335a562be0d06f06b786abaf81a1f2

Download Submit
memory/4700-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4700-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4700-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4944-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4944-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download