f5ae8814230c414f62d9444c409d9e7a81af7413264ed9ea6b3ca63ef82263ea

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 02:01

Target

f5ae8814230c414f62d9444c409d9e7a81af7413264ed9ea6b3ca63ef82263ea.exe
Size

51KB
MD5

315d7aa30b499c1e2ba872a5f8a1e7b2
SHA1

cde40631c920dbc22d208fc1baeea82081477d3b
SHA256

f5ae8814230c414f62d9444c409d9e7a81af7413264ed9ea6b3ca63ef82263ea
SHA512

6eeb01fc4ed1dba5c80043bb03e3aec6400fac8dc04a07e02018535544ce984c9db7e9f252298809ed2f7e71cd3d7d6bb5b2ff8fbd7c69b77c3e62dec39e7ea3
SSDEEP

768:s+pWrOOfbMUI4ybFrcUtxLKxouHd5slovvlLuzTUNhOPSAl4hW:s+pWrvI+UFrjxWxo45slovteYk6U

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4004	dylkemi.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
102	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 4004	3184	f5ae8814230c414f62d9444c409d9e7a81af7413264ed9ea6b3ca63ef82263ea.exe	89
PID 3184 wrote to memory of 4004	3184	f5ae8814230c414f62d9444c409d9e7a81af7413264ed9ea6b3ca63ef82263ea.exe	89
PID 3184 wrote to memory of 4004	3184	f5ae8814230c414f62d9444c409d9e7a81af7413264ed9ea6b3ca63ef82263ea.exe	89

C:\Users\Admin\AppData\Local\Temp\f5ae8814230c414f62d9444c409d9e7a81af7413264ed9ea6b3ca63ef82263ea.exe
"C:\Users\Admin\AppData\Local\Temp\f5ae8814230c414f62d9444c409d9e7a81af7413264ed9ea6b3ca63ef82263ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\dylkemi.exe
  C:\Users\Admin\AppData\Local\Temp\dylkemi.exe
  2⤵
  - Executes dropped EXE
  PID:4004

C:\Users\Admin\AppData\Local\Temp\dylkemi.exe

Filesize
51KB

MD5
e8e3121907b393a39d11ccb1bc4eb733

SHA1
073794c4ec96d4ec5552e362a6759a2cccf20415

SHA256
acc9baeda890175dda491fe7c42cedf15c782a418b16a6a1c57a2b8a653b3369

SHA512
4d64d6a68f3a0f86b7d4433132a0bcdb9c6fcb95056f620d3184f1576a04c550296f8f271a8b61d26276b6e399eb9da9d98e017b76e326d72f9a7401302314ab

Download Submit
memory/3184-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4004-5-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download