81da8bcc8f27ed4adf67b09a20f9a761701b349b1f4708905bfc7a2889b2305b

Analysis

max time kernel
140s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 21:19

Target

1cc71ebdc66ec6fcb2bc57fc7edd84ec.exe
Size

493KB
MD5

1cc71ebdc66ec6fcb2bc57fc7edd84ec
SHA1

474bb0c31a96f061b9ddb2cebc0080126b5b16ad
SHA256

81da8bcc8f27ed4adf67b09a20f9a761701b349b1f4708905bfc7a2889b2305b
SHA512

3c76f6d2ec7281ef4f2c829ce3411591f7630846045e8b67d75687846d23c7164b466845adefd4d9fa54e3ac59c3dfdd27a51382552b017f97ea8a8ed7dfae7a
SSDEEP

12288:MLry/neyx7f/A64j7PSfRYEZeGsG9h0MXlQ:qKeyxTAJj7PSGDGX9NVQ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3324	wfxirm.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\vfwiezpdq\wfxirm.exe	1cc71ebdc66ec6fcb2bc57fc7edd84ec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 3324	2252	1cc71ebdc66ec6fcb2bc57fc7edd84ec.exe	91
PID 2252 wrote to memory of 3324	2252	1cc71ebdc66ec6fcb2bc57fc7edd84ec.exe	91
PID 2252 wrote to memory of 3324	2252	1cc71ebdc66ec6fcb2bc57fc7edd84ec.exe	91

C:\Users\Admin\AppData\Local\Temp\1cc71ebdc66ec6fcb2bc57fc7edd84ec.exe
"C:\Users\Admin\AppData\Local\Temp\1cc71ebdc66ec6fcb2bc57fc7edd84ec.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\vfwiezpdq\wfxirm.exe
  "C:\Program Files (x86)\vfwiezpdq\wfxirm.exe"
  2⤵
  - Executes dropped EXE
  PID:3324

C:\Program Files (x86)\vfwiezpdq\wfxirm.exe

Filesize
507KB

MD5
57ca4695ff3b1a4c0f348594c84e8d86

SHA1
301f1ddb25759ed53afbc76637a95ec210443d0d

SHA256
e002189d6da7031b8e87bb3e37ea4548a856b54d92de49a7af6c9188ddea1a5a

SHA512
7bd11f35a2ede75788fe1db35ef42be1042e6dae32d551ae7d710a0f80dbd1ca0716e7d5b726278fc27f5785659551ec6436d6d50bc6bd7a0b3cfee6f85ce360

Download Submit
memory/2252-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2252-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2252-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3324-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3324-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download