05b9aacd029fb754e2c6a62f0075befadb81f153927bb57fc800541d9dac0743

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 06:53

Target

52d59be6f20287bf1fa5a1ff1dec3a05.exe
Size

598KB
MD5

52d59be6f20287bf1fa5a1ff1dec3a05
SHA1

1ebe7f51ee06d244d99a79fb6a320b1e04b782b9
SHA256

05b9aacd029fb754e2c6a62f0075befadb81f153927bb57fc800541d9dac0743
SHA512

079a77c257755dfe3c27e4b7322cfd2e09cf2ad9305a8ac820afa2dbb4072f97e538c0c1f0bcc9cf92059ef5ae58d8778c6e7d73a33af29afada4ae31523ad24
SSDEEP

12288:MLry/neyx7f/A64j7P+tixhT8n3qBmc1YkVY+wu++wz:qKeyxTAJj7P+yW6mc1YCwuzC

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2336	swvyewtdi.exe

Loads dropped DLL 1 IoCs

pid	Process
2648	52d59be6f20287bf1fa5a1ff1dec3a05.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ghrstld\swvyewtdi.exe	52d59be6f20287bf1fa5a1ff1dec3a05.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2336	2648	52d59be6f20287bf1fa5a1ff1dec3a05.exe	15
PID 2648 wrote to memory of 2336	2648	52d59be6f20287bf1fa5a1ff1dec3a05.exe	15
PID 2648 wrote to memory of 2336	2648	52d59be6f20287bf1fa5a1ff1dec3a05.exe	15
PID 2648 wrote to memory of 2336	2648	52d59be6f20287bf1fa5a1ff1dec3a05.exe	15

C:\Users\Admin\AppData\Local\Temp\52d59be6f20287bf1fa5a1ff1dec3a05.exe
"C:\Users\Admin\AppData\Local\Temp\52d59be6f20287bf1fa5a1ff1dec3a05.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\ghrstld\swvyewtdi.exe
  "C:\Program Files (x86)\ghrstld\swvyewtdi.exe"
  2⤵
  - Executes dropped EXE
  PID:2336

memory/2336-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2648-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2648-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2648-6-0x0000000001CE0000-0x0000000001D74000-memory.dmp

Filesize
592KB

Download
memory/2648-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download