481d0eb03ae2ccf71fb5b41bb3608bb19ffd6a07d32dbc7b939cdd519e45476b

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 12:50

Target

36bf2da5563fc52b905d8a29734fd64d.exe
Size

835KB
MD5

36bf2da5563fc52b905d8a29734fd64d
SHA1

4954cae44dc6d030c6fad69bfa406ffa1211e48d
SHA256

481d0eb03ae2ccf71fb5b41bb3608bb19ffd6a07d32dbc7b939cdd519e45476b
SHA512

a7e4d493fd5fffc988ff544993941040d6eb8f0c4c6ba5cdb39c7859b5d0de91060a99b123cfc91335dc8c2a84ca4965f70ea2695a83f7a8859442269e8faef6
SSDEEP

24576:qKeyxTAJj7P+yW6mc1YCwuv6ez8KTHjTV6LN:qKeyRA0y9fWCw28YFmN

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3868	ygmyuso.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\gekdodco\ygmyuso.exe	36bf2da5563fc52b905d8a29734fd64d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3868	4648	36bf2da5563fc52b905d8a29734fd64d.exe	87
PID 4648 wrote to memory of 3868	4648	36bf2da5563fc52b905d8a29734fd64d.exe	87
PID 4648 wrote to memory of 3868	4648	36bf2da5563fc52b905d8a29734fd64d.exe	87

C:\Users\Admin\AppData\Local\Temp\36bf2da5563fc52b905d8a29734fd64d.exe
"C:\Users\Admin\AppData\Local\Temp\36bf2da5563fc52b905d8a29734fd64d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\gekdodco\ygmyuso.exe
  "C:\Program Files (x86)\gekdodco\ygmyuso.exe"
  2⤵
  - Executes dropped EXE
  PID:3868

C:\Program Files (x86)\gekdodco\ygmyuso.exe

Filesize
173KB

MD5
8570dcfff33ffdc69e2c0d0b393d5133

SHA1
18cc75919236e4fb89a4e260b521b70514c3b0f9

SHA256
1654227fa618a8b6c849540cba9f83f09d156ffe805c6def4bbf47796d2bc671

SHA512
c7331f170a8799259c4231b2b7c9360387fd9b4c87291e15f8ec4471d410efc5803e0f79be0b89db41fde0b131f466bdddcec5b36b53be1610dc63b880ba04b5

Download Submit
C:\Program Files (x86)\gekdodco\ygmyuso.exe

Filesize
74KB

MD5
28c3ba3d8dd097ef90d1aa20f38430aa

SHA1
b1c04c64e5b969bdb88891fd26d4b580c361bad7

SHA256
5e9589d0bb5dd3bdca41645fc70ad453953174a2ac688744b522cc898e81d48f

SHA512
7b5f8f5a1c5513d9e19dde2c90bf89134064d7d4fbce9cd4eb0095665a04a36445e7a23083c80bae47a680d51a5468a9a67e74aaaf7cebd79037d02733341c14

Download Submit
memory/3868-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3868-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4648-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4648-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4648-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download