78f892154c7262fd91b92b479dbce55db921eae8636049031a0cf2f81d8d3bc5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 14:55

Target

d665736ff7ebcdd64d333267ba4b09e3.exe
Size

919KB
MD5

d665736ff7ebcdd64d333267ba4b09e3
SHA1

761f1919dfcccca4b589fdfffcf787cb77111934
SHA256

78f892154c7262fd91b92b479dbce55db921eae8636049031a0cf2f81d8d3bc5
SHA512

99d3e1697b6e2b91caa69d308aec4928568d28f78c33506a61bd6b0f0a448656132987528daf9cb292009c7b4166ca0c53235bb75c4effbf55493f027769d638
SSDEEP

24576:qKeyxTAJj7P+yjUr78DpyW6BdUxDAMZvFbcprx/Uz8X:qKeyRA0yQP8DpyW6Yxbhcrx/Uz8

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2080	zyoaothfjjjvle.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\vqdexu\zyoaothfjjjvle.exe	d665736ff7ebcdd64d333267ba4b09e3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2080	2084	d665736ff7ebcdd64d333267ba4b09e3.exe	90
PID 2084 wrote to memory of 2080	2084	d665736ff7ebcdd64d333267ba4b09e3.exe	90
PID 2084 wrote to memory of 2080	2084	d665736ff7ebcdd64d333267ba4b09e3.exe	90

C:\Users\Admin\AppData\Local\Temp\d665736ff7ebcdd64d333267ba4b09e3.exe
"C:\Users\Admin\AppData\Local\Temp\d665736ff7ebcdd64d333267ba4b09e3.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\vqdexu\zyoaothfjjjvle.exe
  "C:\Program Files (x86)\vqdexu\zyoaothfjjjvle.exe"
  2⤵
  - Executes dropped EXE
  PID:2080

C:\Program Files (x86)\vqdexu\zyoaothfjjjvle.exe

Filesize
930KB

MD5
031d71a714e65b235522af2e780fc659

SHA1
aa04b1ff7cce09db298d045a961801266bb8e3f3

SHA256
c71dc55bc36cdccfdd77d29eb8b601958956ed39d5d01612ca58469e961baf40

SHA512
fa3399d0d0e51938e5adf40cf5ae35cf626bf111606eadc0162ebb386184be9da8dfca0ed7d6db532aaa6b207acb488b7cfc8c0b892de408ac89436ca0459c61

Download Submit
memory/2080-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2080-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2084-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2084-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2084-5-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download