88bff02695c2a22e1f1768f86241d6a74797aaa5a37bcaa48c79d891eebb0c08

Analysis

max time kernel
145s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 04:20

Target

27e8e1952868f69edc14395219a91a8f.exe
Size

64KB
MD5

27e8e1952868f69edc14395219a91a8f
SHA1

ee328dc355246591588b417a5416680f22c83a7e
SHA256

88bff02695c2a22e1f1768f86241d6a74797aaa5a37bcaa48c79d891eebb0c08
SHA512

a4aed9b065d047fc62927fa4d3a4149cd0ba5ed480efd34ffc3f70721c026a68939aa06e65dcd984b4861a7b5eb6d91a5e8a0b6479293c75bb904e232d785ee3
SSDEEP

1536:k7SowfMGR8SZn6pB7Yp2sUUUYNOHwSQvBnhYK//5dh:kiFRXZ6n8bCYoHP6hYKZdh

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2028	vclinglk.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2016	27e8e1952868f69edc14395219a91a8f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2028	2016	27e8e1952868f69edc14395219a91a8f.exe	107
PID 2016 wrote to memory of 2028	2016	27e8e1952868f69edc14395219a91a8f.exe	107
PID 2016 wrote to memory of 2028	2016	27e8e1952868f69edc14395219a91a8f.exe	107
PID 2016 wrote to memory of 3132	2016	27e8e1952868f69edc14395219a91a8f.exe	108
PID 2016 wrote to memory of 3132	2016	27e8e1952868f69edc14395219a91a8f.exe	108
PID 2016 wrote to memory of 3132	2016	27e8e1952868f69edc14395219a91a8f.exe	108

C:\Users\Admin\AppData\Local\Temp\27e8e1952868f69edc14395219a91a8f.exe
"C:\Users\Admin\AppData\Local\Temp\27e8e1952868f69edc14395219a91a8f.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2016
- C:\ProgramData\nkdkjuze\vclinglk.exe
  C:\ProgramData\nkdkjuze\vclinglk.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\SysWOW64\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\27E8E1~1.EXE.bak >> NUL
  2⤵
  PID:3132

C:\ProgramData\nkdkjuze\vclinglk.exe

Filesize
64KB

MD5
27e8e1952868f69edc14395219a91a8f

SHA1
ee328dc355246591588b417a5416680f22c83a7e

SHA256
88bff02695c2a22e1f1768f86241d6a74797aaa5a37bcaa48c79d891eebb0c08

SHA512
a4aed9b065d047fc62927fa4d3a4149cd0ba5ed480efd34ffc3f70721c026a68939aa06e65dcd984b4861a7b5eb6d91a5e8a0b6479293c75bb904e232d785ee3

Download Submit