a5863dae416e573cad2e7aea029f8e6a43a0cc0beaf4c799a90fdcbced9242fd

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 12:31

Target

d384992edc9363b55e1f4d60daeb9d89.exe
Size

798KB
MD5

d384992edc9363b55e1f4d60daeb9d89
SHA1

0519e7f6e130dc779178b5494d6eaf6ce48cf7b4
SHA256

a5863dae416e573cad2e7aea029f8e6a43a0cc0beaf4c799a90fdcbced9242fd
SHA512

cbae4f0ed98f9675647d5e1b7aeec151e59059a3fc3593688500fd5122b27b68e461fb250f88194574c2f12174192932f661f33b3ca7470d592b204f406bd4be
SSDEEP

24576:qKeyxTAJj7PV/s4k+oW6itPl3QtxEjlX27:qKeyRA/t6+PoxWt27

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1276	erltuos.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\varsy\erltuos.exe	d384992edc9363b55e1f4d60daeb9d89.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1276	2196	d384992edc9363b55e1f4d60daeb9d89.exe	89
PID 2196 wrote to memory of 1276	2196	d384992edc9363b55e1f4d60daeb9d89.exe	89
PID 2196 wrote to memory of 1276	2196	d384992edc9363b55e1f4d60daeb9d89.exe	89

C:\Users\Admin\AppData\Local\Temp\d384992edc9363b55e1f4d60daeb9d89.exe
"C:\Users\Admin\AppData\Local\Temp\d384992edc9363b55e1f4d60daeb9d89.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\varsy\erltuos.exe
  "C:\Program Files (x86)\varsy\erltuos.exe"
  2⤵
  - Executes dropped EXE
  PID:1276

C:\Program Files (x86)\varsy\erltuos.exe

Filesize
815KB

MD5
291287620dbe17b77dfdbba75e2a64ec

SHA1
8ae62bddd24be6b63a1118eba3786fcd2c231758

SHA256
a1d594d9d439de2bdcfc38da5ab3d7a3c302d0d4f6d90e8635d00b061af78ccb

SHA512
f191778a18fe2819204db6d77f6814ddea7be8f4dceab04ad99c70f5f3b170b76ca1d3bb3d9fa1aa22673e8ab7dc65007e182b979d77bc30ce50316a4d512157

Download Submit
memory/1276-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1276-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2196-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2196-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2196-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download