706808e116ca8b62a57824bc7e8d477c0fafeccc2009dea9c476d9af6dc02595

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 13:28

Target

bbec6ff5789a0374ee87e2d10a4e3f17.exe
Size

953KB
MD5

bbec6ff5789a0374ee87e2d10a4e3f17
SHA1

4efc09c4ea6feead023874d08aa01246f40b469e
SHA256

706808e116ca8b62a57824bc7e8d477c0fafeccc2009dea9c476d9af6dc02595
SHA512

29fc56c8666e8a4fc3688cdbc925d6d7023c01cbd02a753c50e902daee10b4560f915135d8caeb51dbe17319e7f1df375b0442b63990d0476ada30fa9778f7d3
SSDEEP

24576:qKeyxTAJj7PYJvYN9+i2Z4wWht7snceI7Nc:qKeyRA2JwN9v2+zho1+c

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2980	uuvjhgijruhxl.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\xpng\uuvjhgijruhxl.exe	bbec6ff5789a0374ee87e2d10a4e3f17.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 2980	3464	bbec6ff5789a0374ee87e2d10a4e3f17.exe	85
PID 3464 wrote to memory of 2980	3464	bbec6ff5789a0374ee87e2d10a4e3f17.exe	85
PID 3464 wrote to memory of 2980	3464	bbec6ff5789a0374ee87e2d10a4e3f17.exe	85

C:\Users\Admin\AppData\Local\Temp\bbec6ff5789a0374ee87e2d10a4e3f17.exe
"C:\Users\Admin\AppData\Local\Temp\bbec6ff5789a0374ee87e2d10a4e3f17.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files (x86)\xpng\uuvjhgijruhxl.exe
  "C:\Program Files (x86)\xpng\uuvjhgijruhxl.exe"
  2⤵
  - Executes dropped EXE
  PID:2980

C:\Program Files (x86)\xpng\uuvjhgijruhxl.exe

Filesize
963KB

MD5
4403b866bf4e807901075e10b3cfe262

SHA1
673abfb5da8fd2de660261e866237c5b077c3656

SHA256
e4097d14e40e662c5a207cf9147558a8541bade1c1f8b7ce3c089a322800ec14

SHA512
f5c9fe35f746ac3b1ace47c4316b402b01836825e44ee1a64feaef5dcff64341163309ae1715584859a8871cc98fb4228423fc7d018dbd8e3606311a64436499

Download Submit
memory/2980-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2980-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3464-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3464-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3464-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download