0fde791763b3806ab001abf18778999c4d1d10bed87f3670494fd72463dc261a

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 17:37

Target

0fde791763b3806ab001abf18778999c4d1d10bed87f3670494fd72463dc261a.exe
Size

73KB
MD5

d423b2da599266becc5d92c6b68e3a5f
SHA1

f26db58bdb58b2be1b2706b843d48232c9946a9f
SHA256

0fde791763b3806ab001abf18778999c4d1d10bed87f3670494fd72463dc261a
SHA512

5ee93dffecb9ae7d59b9e5d56a3db9b99071ecbfc35ec7d30822a6959fac9e35d61e23766765077a02401aced5971f673d49b7c98e6e81579d1e680c73d3e246
SSDEEP

1536:DrpAO/e7UsllFYPMHXYuLaOVTKEigiYY6NzKZ2T1:xAO/e7USuOVTKEigoE

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4556	vusjeson.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 4556	2444	0fde791763b3806ab001abf18778999c4d1d10bed87f3670494fd72463dc261a.exe	84
PID 2444 wrote to memory of 4556	2444	0fde791763b3806ab001abf18778999c4d1d10bed87f3670494fd72463dc261a.exe	84
PID 2444 wrote to memory of 4556	2444	0fde791763b3806ab001abf18778999c4d1d10bed87f3670494fd72463dc261a.exe	84

C:\Users\Admin\AppData\Local\Temp\0fde791763b3806ab001abf18778999c4d1d10bed87f3670494fd72463dc261a.exe
"C:\Users\Admin\AppData\Local\Temp\0fde791763b3806ab001abf18778999c4d1d10bed87f3670494fd72463dc261a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\vusjeson.exe
  C:\Users\Admin\AppData\Local\Temp\vusjeson.exe
  2⤵
  - Executes dropped EXE
  PID:4556

C:\Users\Admin\AppData\Local\Temp\vusjeson.exe

Filesize
73KB

MD5
fc71cbdab071dd60a3d0f518fc4db287

SHA1
e3fd2545bb9f4cb1d7e203962965c450b194dc99

SHA256
22b5a94a326e8f15a4f902f3296f74009e070efcadaddbbd73c5c0b25cc1e8c0

SHA512
56a6dc2dbe89897bd3f99d1cf499f3362af86bdb6c2bf1483fd4e149df93676af0ee8148480326329a0ce31b00fa02cc673f5996afc0c4f478f57cd721f98cda

Download Submit
memory/2444-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4556-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download