25fde5716f2f210314cec496e8349b077a26a4c49d7c64880773070e6418f02a

Analysis

max time kernel
159s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 22:25

Target

4753087c99b93a8452cc0502beb349a8.exe
Size

964KB
MD5

4753087c99b93a8452cc0502beb349a8
SHA1

f3f2dc36b0f1b2288c53d5ff39825e52806edf99
SHA256

25fde5716f2f210314cec496e8349b077a26a4c49d7c64880773070e6418f02a
SHA512

9e9c4760a50eafb299b7e7d79ee691ced510c5f45d948b054bcea6350d78ed9be385ecfb895987d5baa71a59284869102d848c99f9711c4d234a529120f94678
SSDEEP

24576:dgdhhQGGniba/WPpuvlBEaneHueYQFSMPPoqqWEskd:dqj5s8+elYQFSMPPgoS

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2828	iyktveqxbgxi.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\vkkfibbh\iyktveqxbgxi.exe	4753087c99b93a8452cc0502beb349a8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2828	4836	4753087c99b93a8452cc0502beb349a8.exe	92
PID 4836 wrote to memory of 2828	4836	4753087c99b93a8452cc0502beb349a8.exe	92
PID 4836 wrote to memory of 2828	4836	4753087c99b93a8452cc0502beb349a8.exe	92

C:\Users\Admin\AppData\Local\Temp\4753087c99b93a8452cc0502beb349a8.exe
"C:\Users\Admin\AppData\Local\Temp\4753087c99b93a8452cc0502beb349a8.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\vkkfibbh\iyktveqxbgxi.exe
  "C:\Program Files (x86)\vkkfibbh\iyktveqxbgxi.exe"
  2⤵
  - Executes dropped EXE
  PID:2828

C:\Program Files (x86)\vkkfibbh\iyktveqxbgxi.exe

Filesize
985KB

MD5
4f798690337e5d26b1dd9669f30adec8

SHA1
e6585dc2422c3aad5cf3b059cbde4799195535a9

SHA256
ff0e6c5d2d89668ba7ff757d79b2f56018d650256de5f4cd012920a365ed7f22

SHA512
090f80ae11a61efc83d59f9c423068eddd3b4188452c3dd89740eafd136a9acf8afabc9099ff47b26ca3e98bc8766481c36478dfeda51a009fa8306aab64a5b9

Download Submit
memory/2828-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4836-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download