8fcea73d785d7d49fe94eaa8dab4a675bfdb8825df1acacfbea88e3b411b84aa

Analysis

max time kernel
127s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 14:15

Target

3978359e270dbbaff07215f2f84cc190.exe
Size

46KB
MD5

3978359e270dbbaff07215f2f84cc190
SHA1

dc30c3448a09373e9f01748d0f5d860f3e991cbb
SHA256

8fcea73d785d7d49fe94eaa8dab4a675bfdb8825df1acacfbea88e3b411b84aa
SHA512

a03299c4b4f56dd0de3921639e47f5d58fa6a573a53446867bc1e44de433f277bb62b742630cd2b53fb7d2375d62b3d5dc5aa5af0766af38d82945a9488d3f01
SSDEEP

768:CL3m+2CdsTZs9LppnG73VObGIyGsuFbDBqxKVN/o7o3cGuvhgUA5eMGCk:CT2CeTZEdtG7Qj19q8AU3cGixA51GCk

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1092	cxezajyd.exe

Loads dropped DLL 2 IoCs

pid	Process
1976	3978359e270dbbaff07215f2f84cc190.exe
1976	3978359e270dbbaff07215f2f84cc190.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1976	3978359e270dbbaff07215f2f84cc190.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1092	1976	3978359e270dbbaff07215f2f84cc190.exe	33
PID 1976 wrote to memory of 1092	1976	3978359e270dbbaff07215f2f84cc190.exe	33
PID 1976 wrote to memory of 1092	1976	3978359e270dbbaff07215f2f84cc190.exe	33
PID 1976 wrote to memory of 1092	1976	3978359e270dbbaff07215f2f84cc190.exe	33

C:\Users\Admin\AppData\Local\Temp\3978359e270dbbaff07215f2f84cc190.exe
"C:\Users\Admin\AppData\Local\Temp\3978359e270dbbaff07215f2f84cc190.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\397835~1.EXE.bak >> NUL
  2⤵
  PID:1808
- C:\ProgramData\wtsvolsh\cxezajyd.exe
  C:\ProgramData\wtsvolsh\cxezajyd.exe
  2⤵
  - Executes dropped EXE
  PID:1092