113b03ec5492e64922c627d6b68a5e810ff528af1253632c36030dc0dac405bf

Analysis

max time kernel
136s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 06:57

Target

2c724219bc0e52083c2eda9a7eb64339.exe
Size

1001KB
MD5

2c724219bc0e52083c2eda9a7eb64339
SHA1

6fd5195b520e8fad05f79fb1d70079b9cb83b378
SHA256

113b03ec5492e64922c627d6b68a5e810ff528af1253632c36030dc0dac405bf
SHA512

e8476d1d4162ba7302a169e3e6be81455cfe9d9ee38dd9c4c0a6e2877ffa0f4890d5b9a2838f9f5668b40ebaff028d95ee5f075ac8b46fd779c1beddccea46fb
SSDEEP

24576:dgdhhQGGniba/WPpuvlBEaneHueYQFSMVbEfRq:dqj5s8+elYQFSMWq

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2964	cpmx.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\zhdqyzaw\cpmx.exe	2c724219bc0e52083c2eda9a7eb64339.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2964	2648	2c724219bc0e52083c2eda9a7eb64339.exe	93
PID 2648 wrote to memory of 2964	2648	2c724219bc0e52083c2eda9a7eb64339.exe	93
PID 2648 wrote to memory of 2964	2648	2c724219bc0e52083c2eda9a7eb64339.exe	93

C:\Users\Admin\AppData\Local\Temp\2c724219bc0e52083c2eda9a7eb64339.exe
"C:\Users\Admin\AppData\Local\Temp\2c724219bc0e52083c2eda9a7eb64339.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\zhdqyzaw\cpmx.exe
  "C:\Program Files (x86)\zhdqyzaw\cpmx.exe"
  2⤵
  - Executes dropped EXE
  PID:2964

C:\Program Files (x86)\zhdqyzaw\cpmx.exe

Filesize
345KB

MD5
dad67052a97a5875df5416a82eae0d36

SHA1
f17c29a2aacd573b12992203e4508ccacd34fed4

SHA256
84a4246f4f065b4fc6648dc37073a320593faaad53efc7bc631d8726757242e7

SHA512
f8bee321c14f4a30b6eedfbd7d20d3d05048d0e5e6e7ca108f9822013a3f441e85d65294b4563b933d5d32efb4ccc0f3111b78dba27487ba1d82ae8252f15404

Download Submit
C:\Program Files (x86)\zhdqyzaw\cpmx.exe

Filesize
229KB

MD5
0cf6f8f7ae274b654e380000b27a320c

SHA1
405913c52cdd3b975b7089f55607d21295ab627e

SHA256
d81c8ef471869b0b34a30b6162f9d9c5117a61c261fa100fb47e9531b700f52a

SHA512
c1f86f7b967a33d098c9310cab25e1699fb702c9b21f4114eaa39f94600feee6836d89a66be35e9ef5a2e7d45f9739495521969d7af36f9b7790eaeb7671174e

Download Submit
memory/2648-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2964-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download