036ef376b6b85f165db23663c8a4a112f59d84272e2623f1eefc200545b8dc6f

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 02:38

Target

9a8ace28d8fd85b635f74ea58cb9d525.exe
Size

56KB
MD5

9a8ace28d8fd85b635f74ea58cb9d525
SHA1

d16c46cd579dc9acbda9f113e06d110a61556721
SHA256

036ef376b6b85f165db23663c8a4a112f59d84272e2623f1eefc200545b8dc6f
SHA512

715f1ee1fa9ab282ba953370ccf1a7a6cc9c38afa76c4003103b3af996d4f44a0c8c04d11d81c96c88be4f2f2e56fdb64534c4a08d752db920b102b92c2f4c7d
SSDEEP

768:mWQfF9Tu89bQwDu3cic4keY9/v5GEJo4Xc+OxJ7HdMLib:mJCi7DusH4/Y9355P5OTbqm

Score

7^/10

Deletes itself 1 IoCs

pid	Process
652	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
588	gzghazer.exe

Loads dropped DLL 2 IoCs

pid	Process
2528	9a8ace28d8fd85b635f74ea58cb9d525.exe
2528	9a8ace28d8fd85b635f74ea58cb9d525.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2528	9a8ace28d8fd85b635f74ea58cb9d525.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2528	9a8ace28d8fd85b635f74ea58cb9d525.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 588	2528	9a8ace28d8fd85b635f74ea58cb9d525.exe	32
PID 2528 wrote to memory of 588	2528	9a8ace28d8fd85b635f74ea58cb9d525.exe	32
PID 2528 wrote to memory of 588	2528	9a8ace28d8fd85b635f74ea58cb9d525.exe	32
PID 2528 wrote to memory of 588	2528	9a8ace28d8fd85b635f74ea58cb9d525.exe	32
PID 2528 wrote to memory of 652	2528	9a8ace28d8fd85b635f74ea58cb9d525.exe	33
PID 2528 wrote to memory of 652	2528	9a8ace28d8fd85b635f74ea58cb9d525.exe	33
PID 2528 wrote to memory of 652	2528	9a8ace28d8fd85b635f74ea58cb9d525.exe	33
PID 2528 wrote to memory of 652	2528	9a8ace28d8fd85b635f74ea58cb9d525.exe	33

C:\Users\Admin\AppData\Local\Temp\9a8ace28d8fd85b635f74ea58cb9d525.exe
"C:\Users\Admin\AppData\Local\Temp\9a8ace28d8fd85b635f74ea58cb9d525.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2528
- C:\ProgramData\wjolqjgn\gzghazer.exe
  C:\ProgramData\wjolqjgn\gzghazer.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\SysWOW64\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\9A8ACE~1.EXE.bak >> NUL
  2⤵
  - Deletes itself
  PID:652

\ProgramData\wjolqjgn\gzghazer.exe

Filesize
56KB

MD5
9a8ace28d8fd85b635f74ea58cb9d525

SHA1
d16c46cd579dc9acbda9f113e06d110a61556721

SHA256
036ef376b6b85f165db23663c8a4a112f59d84272e2623f1eefc200545b8dc6f

SHA512
715f1ee1fa9ab282ba953370ccf1a7a6cc9c38afa76c4003103b3af996d4f44a0c8c04d11d81c96c88be4f2f2e56fdb64534c4a08d752db920b102b92c2f4c7d

Download Submit