550f95515a5b215781734d4f963c51ee2643cd4288b388f5bb7885ce09c2c608

Analysis

max time kernel
135s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 23:55

Target

3f5c149e11be2d664a0d313cb3e921cc.exe
Size

52KB
MD5

3f5c149e11be2d664a0d313cb3e921cc
SHA1

b9e4e4237437cd7bde2f776bcbbab09405df7e74
SHA256

550f95515a5b215781734d4f963c51ee2643cd4288b388f5bb7885ce09c2c608
SHA512

407028d60301edfdee4b61d61eef4a3333f193e199c3a5a21b42067d4ee931ed49665cbde26d07dac7e71e2be6a2bf2612f56bb228c6fbbb4eb0ab8e49334ed4
SSDEEP

768:s2HjJD1hLO1IixdJNgI+QAs31N07DLGw9Fa5ZRDv+kiKxCo10:s2DjpOuijJx3N31NLw9FcJ+AxR10

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1244	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1584	fgfojifg.exe

Loads dropped DLL 2 IoCs

pid	Process
2148	3f5c149e11be2d664a0d313cb3e921cc.exe
2148	3f5c149e11be2d664a0d313cb3e921cc.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2148	3f5c149e11be2d664a0d313cb3e921cc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1584	2148	3f5c149e11be2d664a0d313cb3e921cc.exe	31
PID 2148 wrote to memory of 1584	2148	3f5c149e11be2d664a0d313cb3e921cc.exe	31
PID 2148 wrote to memory of 1584	2148	3f5c149e11be2d664a0d313cb3e921cc.exe	31
PID 2148 wrote to memory of 1584	2148	3f5c149e11be2d664a0d313cb3e921cc.exe	31
PID 2148 wrote to memory of 1244	2148	3f5c149e11be2d664a0d313cb3e921cc.exe	32
PID 2148 wrote to memory of 1244	2148	3f5c149e11be2d664a0d313cb3e921cc.exe	32
PID 2148 wrote to memory of 1244	2148	3f5c149e11be2d664a0d313cb3e921cc.exe	32
PID 2148 wrote to memory of 1244	2148	3f5c149e11be2d664a0d313cb3e921cc.exe	32

C:\Users\Admin\AppData\Local\Temp\3f5c149e11be2d664a0d313cb3e921cc.exe
"C:\Users\Admin\AppData\Local\Temp\3f5c149e11be2d664a0d313cb3e921cc.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2148
- C:\ProgramData\hizktcrg\fgfojifg.exe
  C:\ProgramData\hizktcrg\fgfojifg.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\SysWOW64\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\3F5C14~1.EXE.bak >> NUL
  2⤵
  - Deletes itself
  PID:1244

\ProgramData\hizktcrg\fgfojifg.exe

Filesize
52KB

MD5
3f5c149e11be2d664a0d313cb3e921cc

SHA1
b9e4e4237437cd7bde2f776bcbbab09405df7e74

SHA256
550f95515a5b215781734d4f963c51ee2643cd4288b388f5bb7885ce09c2c608

SHA512
407028d60301edfdee4b61d61eef4a3333f193e199c3a5a21b42067d4ee931ed49665cbde26d07dac7e71e2be6a2bf2612f56bb228c6fbbb4eb0ab8e49334ed4

Download Submit