d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 09:52

Target

d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe
Size

51KB
MD5

4de91c8119233a12715ba542b1c9b424
SHA1

e9dc178ee826a3289d244389e59caef707811ad3
SHA256

d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3
SHA512

d70286ad1955acce9c9bd5d74db6501de6822c7220a57b11507c49f369d25cb0daf7716a4b56d66659568741028d255baa903b8645dcbad3e17c72215d510795
SSDEEP

768:0MXcbpW3DzHcCuO1RwXvHt7VNufGSgoujzkw8f7eObW7i8Goo:0MMbpWT/uORGP/Nu2cHNoo

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1792	ofylywo.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
68	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1792	2624	d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe	89
PID 2624 wrote to memory of 1792	2624	d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe	89
PID 2624 wrote to memory of 1792	2624	d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe	89

C:\Users\Admin\AppData\Local\Temp\d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe
"C:\Users\Admin\AppData\Local\Temp\d1c7cdc5ea25efa65ee7c3ae84ad935c4731ffc50ca222f9781623c4415c74f3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  2⤵
  - Executes dropped EXE
  PID:1792

C:\Users\Admin\AppData\Local\Temp\ofylywo.exe

Filesize
51KB

MD5
fed8644b20d962ddc36889604fe56560

SHA1
cbaffc7e9d2549bca4928349c5360ae2d0ada0c5

SHA256
094433306c74909ec37d1a562545fa6b1055d7ee11cf99a1e6aed425aca5e328

SHA512
6dfb317b468b1498c9f27f8514c4a22dc345b246757e92ff6a397c45180b92da2ac3cdacd3f28cc4c54d5e364bc9f05bf2f03662b73a9c708f9dd1eb5996a65a

Download Submit
memory/1792-5-0x0000000000E80000-0x0000000000E8C000-memory.dmp

Filesize
48KB

Download
memory/2624-0-0x0000000000430000-0x000000000043C000-memory.dmp

Filesize
48KB

Download