b16837613a15d4fd41945f8921ceafc014b33f8956e2796e2ccec570b63e9de4

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 07:29

Target

3c3ff58e99a2b818a41f6f5f82c32bd5.exe
Size

649KB
MD5

3c3ff58e99a2b818a41f6f5f82c32bd5
SHA1

ef7c507754df4ee5bc39134b7a06994c27e402d1
SHA256

b16837613a15d4fd41945f8921ceafc014b33f8956e2796e2ccec570b63e9de4
SHA512

771fce8976c1d1e9836edfc692aa54433894e2795dae7ebfd6eade395cefd35e01facac4e83a7e77230a2585e9068fc162e3789e9a52f62e8459a6bbd71a1852
SSDEEP

12288:MLry/neyx7f/A64j7P+tixhT8n3qBmc1YkVY8606tVY3YuYcvuIH5:qKeyxTAJj7P+yW6mc1Y9iVvuW

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2416	pmp.exe

Loads dropped DLL 1 IoCs

pid	Process
2856	3c3ff58e99a2b818a41f6f5f82c32bd5.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\qxged\pmp.exe	3c3ff58e99a2b818a41f6f5f82c32bd5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2416	2856	3c3ff58e99a2b818a41f6f5f82c32bd5.exe	28
PID 2856 wrote to memory of 2416	2856	3c3ff58e99a2b818a41f6f5f82c32bd5.exe	28
PID 2856 wrote to memory of 2416	2856	3c3ff58e99a2b818a41f6f5f82c32bd5.exe	28
PID 2856 wrote to memory of 2416	2856	3c3ff58e99a2b818a41f6f5f82c32bd5.exe	28

C:\Users\Admin\AppData\Local\Temp\3c3ff58e99a2b818a41f6f5f82c32bd5.exe
"C:\Users\Admin\AppData\Local\Temp\3c3ff58e99a2b818a41f6f5f82c32bd5.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\qxged\pmp.exe
  "C:\Program Files (x86)\qxged\pmp.exe"
  2⤵
  - Executes dropped EXE
  PID:2416

\Program Files (x86)\qxged\pmp.exe

Filesize
667KB

MD5
02058d736ce260f8eb94a4a3c0d7934d

SHA1
5e93b792df4dd4353ec8e2cdc788470fe21cc680

SHA256
781b06bd54cffd6756dbd5451d128625708528a02f9ee344182ffa563ddd917c

SHA512
bbc666ce3bfa7d44b387c365b201475a5d4982b38d748d9948752d608545f73610a1eb069fc362c85b7b9e9da53344593b0bc369afdee4439a98b845b029fbb8

Download Submit
memory/2416-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2416-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2856-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2856-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2856-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download