a5863dae416e573cad2e7aea029f8e6a43a0cc0beaf4c799a90fdcbced9242fd

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 12:31

Target

d384992edc9363b55e1f4d60daeb9d89.exe
Size

798KB
MD5

d384992edc9363b55e1f4d60daeb9d89
SHA1

0519e7f6e130dc779178b5494d6eaf6ce48cf7b4
SHA256

a5863dae416e573cad2e7aea029f8e6a43a0cc0beaf4c799a90fdcbced9242fd
SHA512

cbae4f0ed98f9675647d5e1b7aeec151e59059a3fc3593688500fd5122b27b68e461fb250f88194574c2f12174192932f661f33b3ca7470d592b204f406bd4be
SSDEEP

24576:qKeyxTAJj7PV/s4k+oW6itPl3QtxEjlX27:qKeyRA/t6+PoxWt27

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2220	ptzzrnfox.exe

Loads dropped DLL 1 IoCs

pid	Process
1204	d384992edc9363b55e1f4d60daeb9d89.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ojnmzymgrm\ptzzrnfox.exe	d384992edc9363b55e1f4d60daeb9d89.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2220	1204	d384992edc9363b55e1f4d60daeb9d89.exe	28
PID 1204 wrote to memory of 2220	1204	d384992edc9363b55e1f4d60daeb9d89.exe	28
PID 1204 wrote to memory of 2220	1204	d384992edc9363b55e1f4d60daeb9d89.exe	28
PID 1204 wrote to memory of 2220	1204	d384992edc9363b55e1f4d60daeb9d89.exe	28

C:\Users\Admin\AppData\Local\Temp\d384992edc9363b55e1f4d60daeb9d89.exe
"C:\Users\Admin\AppData\Local\Temp\d384992edc9363b55e1f4d60daeb9d89.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\ojnmzymgrm\ptzzrnfox.exe
  "C:\Program Files (x86)\ojnmzymgrm\ptzzrnfox.exe"
  2⤵
  - Executes dropped EXE
  PID:2220

\Program Files (x86)\ojnmzymgrm\ptzzrnfox.exe

Filesize
822KB

MD5
27ab5606b04c793c1372bd54bf1799d6

SHA1
28f3cbd13391ef7d23c2481c8f0d5ebf001a531e

SHA256
645aba993e723b9efe07170769b8658f191b4cccc1dc142f1010c0d68c83cb54

SHA512
fe71f5ebb93290ce2f7ee7928831eacdca59bac245c57c00bfd2138324e7ecb6cceb44955993d20cf3fda917829be355a74ddc340e21eeb53eb068e4753cea78

Download Submit
memory/1204-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1204-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1204-7-0x0000000001D60000-0x0000000001DF4000-memory.dmp

Filesize
592KB

Download
memory/1204-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2220-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download