b16837613a15d4fd41945f8921ceafc014b33f8956e2796e2ccec570b63e9de4

Analysis

max time kernel
156s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 07:29

Target

3c3ff58e99a2b818a41f6f5f82c32bd5.exe
Size

649KB
MD5

3c3ff58e99a2b818a41f6f5f82c32bd5
SHA1

ef7c507754df4ee5bc39134b7a06994c27e402d1
SHA256

b16837613a15d4fd41945f8921ceafc014b33f8956e2796e2ccec570b63e9de4
SHA512

771fce8976c1d1e9836edfc692aa54433894e2795dae7ebfd6eade395cefd35e01facac4e83a7e77230a2585e9068fc162e3789e9a52f62e8459a6bbd71a1852
SSDEEP

12288:MLry/neyx7f/A64j7P+tixhT8n3qBmc1YkVY8606tVY3YuYcvuIH5:qKeyxTAJj7P+yW6mc1Y9iVvuW

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4332	xgurxhxghtf.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\myuzt\xgurxhxghtf.exe	3c3ff58e99a2b818a41f6f5f82c32bd5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4332	4420	3c3ff58e99a2b818a41f6f5f82c32bd5.exe	27
PID 4420 wrote to memory of 4332	4420	3c3ff58e99a2b818a41f6f5f82c32bd5.exe	27
PID 4420 wrote to memory of 4332	4420	3c3ff58e99a2b818a41f6f5f82c32bd5.exe	27

C:\Users\Admin\AppData\Local\Temp\3c3ff58e99a2b818a41f6f5f82c32bd5.exe
"C:\Users\Admin\AppData\Local\Temp\3c3ff58e99a2b818a41f6f5f82c32bd5.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\myuzt\xgurxhxghtf.exe
  "C:\Program Files (x86)\myuzt\xgurxhxghtf.exe"
  2⤵
  - Executes dropped EXE
  PID:4332

C:\Program Files (x86)\myuzt\xgurxhxghtf.exe

Filesize
665KB

MD5
b6adb15c672f92c7dc5cdbf5ecb5bae5

SHA1
f1985fe71560bd45a3a7c0cece5a4648ec832867

SHA256
8e51c64e31929669c7512eec5a13ca3d9324be4b048fdbac36532bbd0e412727

SHA512
f94982e5e95c09ca7cf7c48de0ca1d2a2507fc4f5b6380372e831e14748b55d6c34ffe8a66e18621be1cf6667bc030e061901ca23ed9ea563ed9c5323e2fca42

Download Submit
memory/4332-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4332-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4420-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4420-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4420-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download