877fb6547caea48da7edcc8c7b27e342e47a9f17dfaa339a724dd3a91f77b3c5

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:29

Target

1b762cecae1fe44dcc9df5eaf0389036.exe
Size

43KB
MD5

1b762cecae1fe44dcc9df5eaf0389036
SHA1

0b9044e9b7df40dcce8b9fc92c5a195d8583d3b8
SHA256

877fb6547caea48da7edcc8c7b27e342e47a9f17dfaa339a724dd3a91f77b3c5
SHA512

89545d81301594195146cceb88b447dd4b2232604b0425ab88f3dff770cc49a2f056296c1041606005f31dac9cb62d0e2236db5ba5c2fa89aa98d3d51c6a1db1
SSDEEP

768:W3kPRtziOk081Kxhobg7rbQX+ugYjKmBvbZ6TJfr/RQT8vIPe4MCEAT6+ZO:jAOh8sxig7rbjzgjcBRJuDjtm+ZO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
820	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
760	xqdovgfw.exe

Loads dropped DLL 2 IoCs

pid	Process
1104	1b762cecae1fe44dcc9df5eaf0389036.exe
1104	1b762cecae1fe44dcc9df5eaf0389036.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1104	1b762cecae1fe44dcc9df5eaf0389036.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 760	1104	1b762cecae1fe44dcc9df5eaf0389036.exe	31
PID 1104 wrote to memory of 760	1104	1b762cecae1fe44dcc9df5eaf0389036.exe	31
PID 1104 wrote to memory of 760	1104	1b762cecae1fe44dcc9df5eaf0389036.exe	31
PID 1104 wrote to memory of 760	1104	1b762cecae1fe44dcc9df5eaf0389036.exe	31
PID 1104 wrote to memory of 820	1104	1b762cecae1fe44dcc9df5eaf0389036.exe	32
PID 1104 wrote to memory of 820	1104	1b762cecae1fe44dcc9df5eaf0389036.exe	32
PID 1104 wrote to memory of 820	1104	1b762cecae1fe44dcc9df5eaf0389036.exe	32
PID 1104 wrote to memory of 820	1104	1b762cecae1fe44dcc9df5eaf0389036.exe	32

C:\Users\Admin\AppData\Local\Temp\1b762cecae1fe44dcc9df5eaf0389036.exe
"C:\Users\Admin\AppData\Local\Temp\1b762cecae1fe44dcc9df5eaf0389036.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1104
- C:\ProgramData\pmzilqnq\xqdovgfw.exe
  C:\ProgramData\pmzilqnq\xqdovgfw.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\SysWOW64\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\1B762C~1.EXE.bak >> NUL
  2⤵
  - Deletes itself
  PID:820

\ProgramData\pmzilqnq\xqdovgfw.exe

Filesize
43KB

MD5
1b762cecae1fe44dcc9df5eaf0389036

SHA1
0b9044e9b7df40dcce8b9fc92c5a195d8583d3b8

SHA256
877fb6547caea48da7edcc8c7b27e342e47a9f17dfaa339a724dd3a91f77b3c5

SHA512
89545d81301594195146cceb88b447dd4b2232604b0425ab88f3dff770cc49a2f056296c1041606005f31dac9cb62d0e2236db5ba5c2fa89aa98d3d51c6a1db1

Download Submit