8e7701f6a4d071142eac4db3b96c48e3e8311b005ce1fb2c0575ed968e57747c

Analysis

max time kernel
135s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 02:52

Target

474011840745ca5405e383b3c8998353.exe
Size

64KB
MD5

474011840745ca5405e383b3c8998353
SHA1

77305ad6f711172ece9474755edede0b2e9ac0c4
SHA256

8e7701f6a4d071142eac4db3b96c48e3e8311b005ce1fb2c0575ed968e57747c
SHA512

625c9bea63a8aef73e7b4412a74aa596eb2ca52505138783985946e3c0e963b364005443aeaa1707a6954a1f8ae23c6f3088338608a8bc97f1bcf8651321dc2b
SSDEEP

1536:Pd9P9XPGUrxREZkYENR9Sg1ihF2gik97sJnrf:3FVzf9R9SQmEbn

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1268	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1188	pkdgtmhu.exe

Loads dropped DLL 2 IoCs

pid	Process
1712	474011840745ca5405e383b3c8998353.exe
1712	474011840745ca5405e383b3c8998353.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1712	474011840745ca5405e383b3c8998353.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1188	1712	474011840745ca5405e383b3c8998353.exe	31
PID 1712 wrote to memory of 1188	1712	474011840745ca5405e383b3c8998353.exe	31
PID 1712 wrote to memory of 1188	1712	474011840745ca5405e383b3c8998353.exe	31
PID 1712 wrote to memory of 1188	1712	474011840745ca5405e383b3c8998353.exe	31
PID 1712 wrote to memory of 1268	1712	474011840745ca5405e383b3c8998353.exe	32
PID 1712 wrote to memory of 1268	1712	474011840745ca5405e383b3c8998353.exe	32
PID 1712 wrote to memory of 1268	1712	474011840745ca5405e383b3c8998353.exe	32
PID 1712 wrote to memory of 1268	1712	474011840745ca5405e383b3c8998353.exe	32

C:\Users\Admin\AppData\Local\Temp\474011840745ca5405e383b3c8998353.exe
"C:\Users\Admin\AppData\Local\Temp\474011840745ca5405e383b3c8998353.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1712
- C:\ProgramData\xspyhmza\pkdgtmhu.exe
  C:\ProgramData\xspyhmza\pkdgtmhu.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\SysWOW64\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\474011~1.EXE.bak >> NUL
  2⤵
  - Deletes itself
  PID:1268

\ProgramData\xspyhmza\pkdgtmhu.exe

Filesize
64KB

MD5
474011840745ca5405e383b3c8998353

SHA1
77305ad6f711172ece9474755edede0b2e9ac0c4

SHA256
8e7701f6a4d071142eac4db3b96c48e3e8311b005ce1fb2c0575ed968e57747c

SHA512
625c9bea63a8aef73e7b4412a74aa596eb2ca52505138783985946e3c0e963b364005443aeaa1707a6954a1f8ae23c6f3088338608a8bc97f1bcf8651321dc2b

Download Submit