89a21f3ca6cb9e3d18b04d8c2f2d2d8f2975ae16bedfe5d56ae0df8a55734f53

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 03:37

Target

5a2c5e4d0be6406b96b96ec26d96e892.exe
Size

1.2MB
MD5

5a2c5e4d0be6406b96b96ec26d96e892
SHA1

84c814842a8b958f294cc61a30e9159f17705e42
SHA256

89a21f3ca6cb9e3d18b04d8c2f2d2d8f2975ae16bedfe5d56ae0df8a55734f53
SHA512

b63936f515ba0d7c2e3afafef46ded27cf271d1cb29bc1b2cb047628d942039126b1bfd36bca09b3e54529ae2b0c026df10221956004baa4d2cea58855a61265
SSDEEP

24576:7zXKqa8SEijjC+37liXbLbklmfB6/tbQdSmKBQXj3LdRWi:7z6qaakjC+3srLAKB61bQd3KaXb/Wi

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1864	mjgobpnavxrhcf.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\bcjzs\mjgobpnavxrhcf.exe	5a2c5e4d0be6406b96b96ec26d96e892.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1864	2084	5a2c5e4d0be6406b96b96ec26d96e892.exe	28
PID 2084 wrote to memory of 1864	2084	5a2c5e4d0be6406b96b96ec26d96e892.exe	28
PID 2084 wrote to memory of 1864	2084	5a2c5e4d0be6406b96b96ec26d96e892.exe	28

C:\Users\Admin\AppData\Local\Temp\5a2c5e4d0be6406b96b96ec26d96e892.exe
"C:\Users\Admin\AppData\Local\Temp\5a2c5e4d0be6406b96b96ec26d96e892.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\bcjzs\mjgobpnavxrhcf.exe
  "C:\Program Files (x86)\bcjzs\mjgobpnavxrhcf.exe"
  2⤵
  - Executes dropped EXE
  PID:1864

C:\Program Files (x86)\bcjzs\mjgobpnavxrhcf.exe

Filesize
57KB

MD5
74fb65fe51406835c00c1b8bed5428d4

SHA1
58f7f4e1688f2c8d9f676d98976d49172173b851

SHA256
11eb1c10b435f5fce623fad230b33a6c133e50e927fa1f33b9e43e324eb761a7

SHA512
9f21b8fe2019e7f91de078dcc21736200da3b6fa55144ab51c4052a10989096da162bb079a87311f8dbe351cecfd160bcc684639e7f1fa3193b124ad9e9a22ff

Download Submit
C:\Program Files (x86)\bcjzs\mjgobpnavxrhcf.exe

Filesize
110KB

MD5
9da97337d9f8915e6835bc046497949b

SHA1
53f5f263397e956949b16b983468dcb91913c6bc

SHA256
4d74c1967b510effa46f616515bb0f7ef33f3b7ac5d314ef315c0c39e81a3452

SHA512
ee2c8c7f5041f6b0a7bfae1be3898a58d1ca30607c7660588caf6f9dd77c8ee90cbc7f5bdb50b6d308e42a38c53968250292e5c6f94f1a1bb7b2d8b207a029b0

Download Submit
memory/1864-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1864-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2084-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2084-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2084-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download