e1ce23ecbc870e1aa1bc79cec54af0d13ddec7c00870fbdd5bba6fc56d14cb66

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 03:52

Target

765036d77afb2c23defd84e520ec9d7d.exe
Size

459KB
MD5

765036d77afb2c23defd84e520ec9d7d
SHA1

abf295ec2acce422ce8225090a4cf94988c52efc
SHA256

e1ce23ecbc870e1aa1bc79cec54af0d13ddec7c00870fbdd5bba6fc56d14cb66
SHA512

8b90f6b8e39f992485da967ec0c62817860d34ea7bfbe127209061a70d986db9e8d27fb940f9fb129e8ea58f7c3e94ec436cdac2183eeb2572a268a1af691897
SSDEEP

12288:MLry/neyx7f/A64j7P+tixhT8nWfUFkF7U:qKeyxTAJj7P+yWwFY

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3720	eynuj.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\vjhj\eynuj.exe	765036d77afb2c23defd84e520ec9d7d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 3720	796	765036d77afb2c23defd84e520ec9d7d.exe	85
PID 796 wrote to memory of 3720	796	765036d77afb2c23defd84e520ec9d7d.exe	85
PID 796 wrote to memory of 3720	796	765036d77afb2c23defd84e520ec9d7d.exe	85

C:\Users\Admin\AppData\Local\Temp\765036d77afb2c23defd84e520ec9d7d.exe
"C:\Users\Admin\AppData\Local\Temp\765036d77afb2c23defd84e520ec9d7d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:796
- C:\Program Files (x86)\vjhj\eynuj.exe
  "C:\Program Files (x86)\vjhj\eynuj.exe"
  2⤵
  - Executes dropped EXE
  PID:3720

C:\Program Files (x86)\vjhj\eynuj.exe

Filesize
254KB

MD5
9b159df4e20a06c9d4205534a2529156

SHA1
f6aeedd1f2e13b511db681379a823c00b3a4d338

SHA256
680d5646067fe3552c0aacdb820257cf0c5574c19c21920e81db05bb073becd7

SHA512
8582c2bc53101ba9ce8b4e1f6d63770eb37d691904e285bb086ac93fa98489f8579dc01e2752ed1a08a3a3dd421ffdc513e76bf11aeda44ae59cd30f2ba40cb4

Download Submit
C:\Program Files (x86)\vjhj\eynuj.exe

Filesize
147KB

MD5
99828987a0bb298d707999213a2fcff3

SHA1
4e0dba5fed5f1cdcfc4b0d2e34a5e226219a7d72

SHA256
7abef85acc42657dad377a4116f16a9d95cfa7b0957805bf4d998acb65fa6bc5

SHA512
4d710ea930abbec43b87676b2c0a2c9c641244fa982b4c67f3f4c74551392fa6e27590cb7cd105af53d43d1cbcaee6ae37ec4088d65c1c0bfd1c10d2e3e1e81e

Download Submit
memory/796-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/796-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/796-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3720-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3720-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download