706808e116ca8b62a57824bc7e8d477c0fafeccc2009dea9c476d9af6dc02595

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 13:28

Target

bbec6ff5789a0374ee87e2d10a4e3f17.exe
Size

953KB
MD5

bbec6ff5789a0374ee87e2d10a4e3f17
SHA1

4efc09c4ea6feead023874d08aa01246f40b469e
SHA256

706808e116ca8b62a57824bc7e8d477c0fafeccc2009dea9c476d9af6dc02595
SHA512

29fc56c8666e8a4fc3688cdbc925d6d7023c01cbd02a753c50e902daee10b4560f915135d8caeb51dbe17319e7f1df375b0442b63990d0476ada30fa9778f7d3
SSDEEP

24576:qKeyxTAJj7PYJvYN9+i2Z4wWht7snceI7Nc:qKeyRA2JwN9v2+zho1+c

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3020	ygaoxif.exe

Loads dropped DLL 1 IoCs

pid	Process
1288	bbec6ff5789a0374ee87e2d10a4e3f17.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\jvmdqua\ygaoxif.exe	bbec6ff5789a0374ee87e2d10a4e3f17.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 3020	1288	bbec6ff5789a0374ee87e2d10a4e3f17.exe	28
PID 1288 wrote to memory of 3020	1288	bbec6ff5789a0374ee87e2d10a4e3f17.exe	28
PID 1288 wrote to memory of 3020	1288	bbec6ff5789a0374ee87e2d10a4e3f17.exe	28
PID 1288 wrote to memory of 3020	1288	bbec6ff5789a0374ee87e2d10a4e3f17.exe	28

C:\Users\Admin\AppData\Local\Temp\bbec6ff5789a0374ee87e2d10a4e3f17.exe
"C:\Users\Admin\AppData\Local\Temp\bbec6ff5789a0374ee87e2d10a4e3f17.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\jvmdqua\ygaoxif.exe
  "C:\Program Files (x86)\jvmdqua\ygaoxif.exe"
  2⤵
  - Executes dropped EXE
  PID:3020

\Program Files (x86)\jvmdqua\ygaoxif.exe

Filesize
970KB

MD5
d14d083ef04312139c0ddc9657154d88

SHA1
9f0ec780cfac79d26521959e95550f82b654e5c5

SHA256
c4a3c975508b5ff0abac1e307402ee7dc7c89a6062fff291f355d98042d22ed9

SHA512
e4f956e6cc85a8910b1a830d5a72e1c9ad6beee8975c2505b75f272a5cebf0ea2b6c51c6d8b2a9c1c182b4e26efd2e3719123745fab0db1446e0b2e792a1095e

Download Submit
memory/1288-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1288-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1288-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1288-5-0x0000000000230000-0x00000000002C4000-memory.dmp

Filesize
592KB

Download
memory/1288-11-0x0000000000230000-0x00000000002C4000-memory.dmp

Filesize
592KB

Download
memory/3020-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3020-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download