f5d903dae25bdf584a7cefa167c375ea557bf22c5e8e06f54dc295f19f176601

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 07:56

Target

76cde6103ebbb013cc44efdf1829a049.exe
Size

746KB
MD5

76cde6103ebbb013cc44efdf1829a049
SHA1

95bb985a120062c7db280501897bb2c7c90dca59
SHA256

f5d903dae25bdf584a7cefa167c375ea557bf22c5e8e06f54dc295f19f176601
SHA512

28b86298a484e0e269474277dc18294503a2d971ebd9515910183f83a2923a4fcff6cadddcd7447fb55444de661a2f792430f1ccc67ae5511496550fe62845a4
SSDEEP

12288:MLry/neyx7f/A64j7P+tixhT8n3qBmc1YkVY+wu+AVsrpk3wgJoVbbD+tb:qKeyxTAJj7P+yW6mc1YCwuRVsrpO+FGh

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1268	gpnuy.exe

Loads dropped DLL 1 IoCs

pid	Process
2436	76cde6103ebbb013cc44efdf1829a049.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\kgzru\gpnuy.exe	76cde6103ebbb013cc44efdf1829a049.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1268	2436	76cde6103ebbb013cc44efdf1829a049.exe	28
PID 2436 wrote to memory of 1268	2436	76cde6103ebbb013cc44efdf1829a049.exe	28
PID 2436 wrote to memory of 1268	2436	76cde6103ebbb013cc44efdf1829a049.exe	28
PID 2436 wrote to memory of 1268	2436	76cde6103ebbb013cc44efdf1829a049.exe	28

C:\Users\Admin\AppData\Local\Temp\76cde6103ebbb013cc44efdf1829a049.exe
"C:\Users\Admin\AppData\Local\Temp\76cde6103ebbb013cc44efdf1829a049.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\kgzru\gpnuy.exe
  "C:\Program Files (x86)\kgzru\gpnuy.exe"
  2⤵
  - Executes dropped EXE
  PID:1268

\Program Files (x86)\kgzru\gpnuy.exe

Filesize
765KB

MD5
bd873d0bd1431213530ee48a357d86e1

SHA1
d0920df26e12707e7820eb2fd225fff4f6c44f57

SHA256
730d3133c19c1309d913de514bf199868ed2545daa639b5b6e8c5a36ba857b56

SHA512
d74b4bf43822d54a700339231b613279804c7431e6fd7ce72c2dff9bc99ed829eff08976c699d38ac30341a9c46638e8dc4e60a0a6b766bb12da0222c05aba06

Download Submit
memory/1268-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1268-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2436-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2436-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2436-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download