ac47433161da74e7b625bfb51583891bbb15e3f1d3b9903c28101689835dd467

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 02:01

Target

d4f018848d0649e7532fdc225ba35218.exe
Size

650KB
MD5

d4f018848d0649e7532fdc225ba35218
SHA1

e585b5193b26dcd98460f20a5b02349171ee0403
SHA256

ac47433161da74e7b625bfb51583891bbb15e3f1d3b9903c28101689835dd467
SHA512

1245b4c678260cf5d7b18436ef1bc184c15375ef36968e879898dd0b49fa3ff7a4de5776f024b20049aaf0190a09f8ad827b73f0a365b67d2d791ce54a2d0d5d
SSDEEP

12288:MLry/neyx7f/A64j7P+tixhT8n3qBmc1YkVYcrKZnfJPRZINZN:qKeyxTAJj7P+yW6mc1YgeZfZRZIDN

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5028	wzvfpvohot.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\imlyqlgqj\wzvfpvohot.exe	d4f018848d0649e7532fdc225ba35218.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 5028	4504	d4f018848d0649e7532fdc225ba35218.exe	90
PID 4504 wrote to memory of 5028	4504	d4f018848d0649e7532fdc225ba35218.exe	90
PID 4504 wrote to memory of 5028	4504	d4f018848d0649e7532fdc225ba35218.exe	90

C:\Users\Admin\AppData\Local\Temp\d4f018848d0649e7532fdc225ba35218.exe
"C:\Users\Admin\AppData\Local\Temp\d4f018848d0649e7532fdc225ba35218.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files (x86)\imlyqlgqj\wzvfpvohot.exe
  "C:\Program Files (x86)\imlyqlgqj\wzvfpvohot.exe"
  2⤵
  - Executes dropped EXE
  PID:5028

C:\Program Files (x86)\imlyqlgqj\wzvfpvohot.exe

Filesize
674KB

MD5
dfbfbfb2951f8e9d4a8c6b0e0d48d38c

SHA1
9d63f92d4f2a77a696d9a368441fe47eee84c194

SHA256
5febce603366ad7de88b153f3dd44bccc35d04c5184bd7e16a99c263dcdbb197

SHA512
ead1eb5f43d789939f546b69157f7ba07c1a1e671ddcf4ff05c43212800237025dfde538370ba96fc538121150f4f8f1a95e71e821b466dc6aedd85ec0e59fe2

Download Submit
memory/4504-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4504-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4504-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/5028-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/5028-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download