97880d5ab210fdf944a9409db9536fec2fb01b427ba21da3ae72887f71948b05

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 05:24

Target

ab1aaca16e9f584a849e53c522c1948a.exe
Size

580KB
MD5

ab1aaca16e9f584a849e53c522c1948a
SHA1

cbe18b89619fa684b0e884a1461c1ea83d010eb1
SHA256

97880d5ab210fdf944a9409db9536fec2fb01b427ba21da3ae72887f71948b05
SHA512

898fb3ad4500c6f56ceb95fc58cc1df4cd565f3dc1c742ca778dc69717e958d1de9e945886977754fa508044e80ab574f011b3f7e86606533b9e626879514fd2
SSDEEP

12288:MLry/neyx7f/A64j7PV/F2VC+QyHDaiyJ2WvyiRPsb1OrN:qKeyxTAJj7PV/s4k+oW6itSOrN

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2172	hyxbnkep.exe

Loads dropped DLL 1 IoCs

pid	Process
1932	ab1aaca16e9f584a849e53c522c1948a.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\trhfsgvzc\hyxbnkep.exe	ab1aaca16e9f584a849e53c522c1948a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2172	1932	ab1aaca16e9f584a849e53c522c1948a.exe	28
PID 1932 wrote to memory of 2172	1932	ab1aaca16e9f584a849e53c522c1948a.exe	28
PID 1932 wrote to memory of 2172	1932	ab1aaca16e9f584a849e53c522c1948a.exe	28
PID 1932 wrote to memory of 2172	1932	ab1aaca16e9f584a849e53c522c1948a.exe	28

C:\Users\Admin\AppData\Local\Temp\ab1aaca16e9f584a849e53c522c1948a.exe
"C:\Users\Admin\AppData\Local\Temp\ab1aaca16e9f584a849e53c522c1948a.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\trhfsgvzc\hyxbnkep.exe
  "C:\Program Files (x86)\trhfsgvzc\hyxbnkep.exe"
  2⤵
  - Executes dropped EXE
  PID:2172

\Program Files (x86)\trhfsgvzc\hyxbnkep.exe

Filesize
593KB

MD5
f6c13d2a7f3b86c403630cbe0495177e

SHA1
c5a32c0463a0eda40a6364ad13ebcb79dcda7ff8

SHA256
8b4b68c90d5aa6589b2e659ffc31a179eec20ce1c5a727c3c7502d6d9487e5b1

SHA512
dc12849fd8b679ae3876d1560859621adc69246a6968c3f9efa5224935f3c8de5ba16d49c66ede6272fd3b2b961bbded8e5504f601163a5f8da01af3e2684a48

Download Submit
memory/1932-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1932-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1932-7-0x0000000000230000-0x00000000002C4000-memory.dmp

Filesize
592KB

Download
memory/1932-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2172-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2172-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2172-11-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download