83ce37cb397f0b56039da57335d3f90f7359ddb988037c14577c6c119a6ee360

Analysis

max time kernel
169s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 01:03

Target

bd415929c3070c234d686d3e30269b04.exe
Size

1.9MB
MD5

bd415929c3070c234d686d3e30269b04
SHA1

8d12e97f315419d2b06d32ec617a450d2cef1db3
SHA256

83ce37cb397f0b56039da57335d3f90f7359ddb988037c14577c6c119a6ee360
SHA512

3b1bbd4fcab599964a0c4e8be9c41079631985c5a2870e44028e7fe3d893157f708ca3ae087cfcbeada65abc18c44f7c0e33741e764df8e2f094eeddc1d96c43
SSDEEP

24576:dgdhhQGGnnazLpj4VHogiuGYNycAavew3mwmI1nk30sKbcGOyRWEMVM8w8sDDm0h:dqgazxcGYN139lnk30raY7zB

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1164	bkgdin.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\xcwwsyl\bkgdin.exe	bd415929c3070c234d686d3e30269b04.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1164	880	bd415929c3070c234d686d3e30269b04.exe	95
PID 880 wrote to memory of 1164	880	bd415929c3070c234d686d3e30269b04.exe	95
PID 880 wrote to memory of 1164	880	bd415929c3070c234d686d3e30269b04.exe	95

C:\Users\Admin\AppData\Local\Temp\bd415929c3070c234d686d3e30269b04.exe
"C:\Users\Admin\AppData\Local\Temp\bd415929c3070c234d686d3e30269b04.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:880
- C:\Program Files (x86)\xcwwsyl\bkgdin.exe
  "C:\Program Files (x86)\xcwwsyl\bkgdin.exe"
  2⤵
  - Executes dropped EXE
  PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3348 --field-trial-handle=2256,i,18272763564106695635,11201593968620719822,262144 --variations-seed-version /prefetch:8
1⤵
PID:4488

C:\Program Files (x86)\xcwwsyl\bkgdin.exe

Filesize
1.9MB

MD5
fbdd8935d04cc56e45aad42d0a4adb4f

SHA1
c7976c89708d7cb180dde74ba2cc8062a58fbc32

SHA256
ff215d762d2812df3f85d7f09f977e522e85e5db446ae345aacf14f89720aa06

SHA512
510051dbedb4e6c160794c156cdb4ed36b7b6156bf67c31d672b00cf55ead5432f3c751a709fd410ffc23e4eeed846f05b3f52c9f215e60a2902302190512a4d

Download Submit
memory/880-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1164-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download