8e7701f6a4d071142eac4db3b96c48e3e8311b005ce1fb2c0575ed968e57747c

Analysis

max time kernel
69s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 02:52

Target

474011840745ca5405e383b3c8998353.exe
Size

64KB
MD5

474011840745ca5405e383b3c8998353
SHA1

77305ad6f711172ece9474755edede0b2e9ac0c4
SHA256

8e7701f6a4d071142eac4db3b96c48e3e8311b005ce1fb2c0575ed968e57747c
SHA512

625c9bea63a8aef73e7b4412a74aa596eb2ca52505138783985946e3c0e963b364005443aeaa1707a6954a1f8ae23c6f3088338608a8bc97f1bcf8651321dc2b
SSDEEP

1536:Pd9P9XPGUrxREZkYENR9Sg1ihF2gik97sJnrf:3FVzf9R9SQmEbn

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
428	nifyvqrk.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4748	474011840745ca5405e383b3c8998353.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 428	4748	474011840745ca5405e383b3c8998353.exe	104
PID 4748 wrote to memory of 428	4748	474011840745ca5405e383b3c8998353.exe	104
PID 4748 wrote to memory of 428	4748	474011840745ca5405e383b3c8998353.exe	104
PID 4748 wrote to memory of 4732	4748	474011840745ca5405e383b3c8998353.exe	103
PID 4748 wrote to memory of 4732	4748	474011840745ca5405e383b3c8998353.exe	103
PID 4748 wrote to memory of 4732	4748	474011840745ca5405e383b3c8998353.exe	103

C:\Users\Admin\AppData\Local\Temp\474011840745ca5405e383b3c8998353.exe
"C:\Users\Admin\AppData\Local\Temp\474011840745ca5405e383b3c8998353.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\474011~1.EXE.bak >> NUL
  2⤵
  PID:4732
- C:\ProgramData\jejavmpk\nifyvqrk.exe
  C:\ProgramData\jejavmpk\nifyvqrk.exe
  2⤵
  - Executes dropped EXE
  PID:428

C:\ProgramData\jejavmpk\nifyvqrk.exe

Filesize
64KB

MD5
474011840745ca5405e383b3c8998353

SHA1
77305ad6f711172ece9474755edede0b2e9ac0c4

SHA256
8e7701f6a4d071142eac4db3b96c48e3e8311b005ce1fb2c0575ed968e57747c

SHA512
625c9bea63a8aef73e7b4412a74aa596eb2ca52505138783985946e3c0e963b364005443aeaa1707a6954a1f8ae23c6f3088338608a8bc97f1bcf8651321dc2b

Download Submit