e027282f4ac08c252c0b9411631c82a7a9ffeec3ffc704d6edafe96a4673cc65

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 21:44

Target

e027282f4ac08c252c0b9411631c82a7a9ffeec3ffc704d6edafe96a4673cc65.exe
Size

94KB
MD5

335a7a0260e1f43fcca29a1433ffe6e5
SHA1

fb6e67cc03d35af1c24a08e66ebbd65bdee6557b
SHA256

e027282f4ac08c252c0b9411631c82a7a9ffeec3ffc704d6edafe96a4673cc65
SHA512

ada1bb2705c85672789d0c90c323440eddc95c3340a5f9b57bed7ad1e8f9661543c1d485624c2df2e476f39d1dbe970b994798142ce8194b90db106290661b00
SSDEEP

1536:jKywN8I/DY9eUtll6CMLk1IJ5n4+gkYTjipvF2PmEgKQ9Jr3Ek:GNbD3UDIJ5n4+gkYvQd2y

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1784	vusjeson.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1784	2972	e027282f4ac08c252c0b9411631c82a7a9ffeec3ffc704d6edafe96a4673cc65.exe	86
PID 2972 wrote to memory of 1784	2972	e027282f4ac08c252c0b9411631c82a7a9ffeec3ffc704d6edafe96a4673cc65.exe	86
PID 2972 wrote to memory of 1784	2972	e027282f4ac08c252c0b9411631c82a7a9ffeec3ffc704d6edafe96a4673cc65.exe	86

C:\Users\Admin\AppData\Local\Temp\e027282f4ac08c252c0b9411631c82a7a9ffeec3ffc704d6edafe96a4673cc65.exe
"C:\Users\Admin\AppData\Local\Temp\e027282f4ac08c252c0b9411631c82a7a9ffeec3ffc704d6edafe96a4673cc65.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\vusjeson.exe
  C:\Users\Admin\AppData\Local\Temp\vusjeson.exe
  2⤵
  - Executes dropped EXE
  PID:1784

C:\Users\Admin\AppData\Local\Temp\vusjeson.exe

Filesize
95KB

MD5
7a60a8025f6dc47a7001ed9ce0217416

SHA1
f303e5fdfcee3c6b85798c48791790da11d0818e

SHA256
4a967e27b967671299245c9338dc2779955b2feedbf7e3a0b803c194c381f6df

SHA512
ac6fbd929abeabd359d566176d9f72ffcbc432d9a6a651f03c5a3362771812f3f7de6d42585c28b61b3c67783c27a53feee9e48a73b2edf0a749ac4508d98881

Download Submit
memory/1784-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2972-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download