c3c0544ae9f8d463fc885edb8bd72cba550728a86c760217af9011a8ffdcf328

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 18:29

Target

72bde685521eee09d4f8986d28204190.exe
Size

370KB
MD5

72bde685521eee09d4f8986d28204190
SHA1

c4149e000d08d565fad211de45a7bbdf12bfbdea
SHA256

c3c0544ae9f8d463fc885edb8bd72cba550728a86c760217af9011a8ffdcf328
SHA512

ceb6f9879bb605e0e8c3ca5e22770c0acf34ff86c6949761d59a50e2a53d702422ce9a443ed51b5c4720962b79adc43166fbcafccc4d04d3da7c8c63654b2ead
SSDEEP

6144:MTykDONo0jv7IoPfeq1ZzxRJbL7f5LAh36rSLL64j7W4+yQrOx5Yszv8Qnf:MLry/neyx7f/A64j7P+tixhT8k

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4376	zawizlywhwqjk.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\tnfae\zawizlywhwqjk.exe	72bde685521eee09d4f8986d28204190.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4376	1124	72bde685521eee09d4f8986d28204190.exe	85
PID 1124 wrote to memory of 4376	1124	72bde685521eee09d4f8986d28204190.exe	85
PID 1124 wrote to memory of 4376	1124	72bde685521eee09d4f8986d28204190.exe	85

C:\Users\Admin\AppData\Local\Temp\72bde685521eee09d4f8986d28204190.exe
"C:\Users\Admin\AppData\Local\Temp\72bde685521eee09d4f8986d28204190.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\tnfae\zawizlywhwqjk.exe
  "C:\Program Files (x86)\tnfae\zawizlywhwqjk.exe"
  2⤵
  - Executes dropped EXE
  PID:4376

C:\Program Files (x86)\tnfae\zawizlywhwqjk.exe

Filesize
383KB

MD5
f37135d3b8c6b1361836084cb5b71353

SHA1
535ca7f4d9eb6966c87b99fdb15d762457da930c

SHA256
0698505d82e23c0227fb4426b16e3f5c973194ed0b364c2926304e8c1b4e8a1c

SHA512
0f69b255f2f5809ae11f634a33956f2cbdd38b32a30a101018d9c33de5490943a8d5f39624f327fedbefb9940840523bdab1bece9f8c1ca5ebaf7b6484c44b35

Download Submit
memory/1124-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1124-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1124-5-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4376-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4376-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download