ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 01:13

Target

ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe
Size

448KB
MD5

23a6a4f6dfc1afad891316e24a4894a1
SHA1

65f67162cb17103ab48844e8e4c59ae9c1c40466
SHA256

ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3
SHA512

00f7d255119d74728b7d0286fe6eca2ebcbf1a77c33f566c1f85f99e90203469656769a5c937ba6515f3571f493762bd883614fa8153ec1b4d31b8bd48228e85
SSDEEP

12288:Vm0NyXgC8FoCNXSNpCyfi0npM4dl0v5JdmA:VPNywC8CCUNpCyfiEM4dmv5r

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3048	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe

Executes dropped EXE 1 IoCs

pid	Process
3048	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe

Loads dropped DLL 1 IoCs

pid	Process
2008	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2008	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3048	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 3048	2008	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe	27
PID 2008 wrote to memory of 3048	2008	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe	27
PID 2008 wrote to memory of 3048	2008	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe	27
PID 2008 wrote to memory of 3048	2008	ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe	27

\Users\Admin\AppData\Local\Temp\ef79545ac0f3eb5a4e7aab6df8f7789f94f60522a5a7169293fb577883e1a9d3.exe

Filesize
448KB

MD5
6d9a54a821ca34f83fe25aa5ff9ca514

SHA1
3542de20460b4575d7441892b821c7f4739c4cd3

SHA256
3de475794f003c21d968c3a96e6c824b1d5a824122673c0731672137063d4477

SHA512
c614ed3db1a33965df964e2b2e047dd0fc1b104d7ddb03bf29f1080d53432f1d112233859a381c977df077ebb2625b78ca032664eddbafdfe1b731d4450fccff

Download Submit
memory/2008-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2008-5-0x0000000000130000-0x000000000016F000-memory.dmp

Filesize
252KB

Download
memory/2008-10-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2008-18-0x0000000000130000-0x000000000016F000-memory.dmp

Filesize
252KB

Download
memory/3048-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3048-11-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3048-14-0x00000000001E0000-0x000000000021F000-memory.dmp

Filesize
252KB

Download
memory/3048-19-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download