2fec48e7d7433bf514db35fcafa55ed1516b5c7e458663c4faa0c8bd309ddd8a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 19:53

Target

2fec48e7d7433bf514db35fcafa55ed1516b5c7e458663c4faa0c8bd309ddd8a.exe
Size

73KB
MD5

4d36ff0bf7a3f20d561ff940e85911ff
SHA1

924fd90e60f64552eb552058542a615c0a94fc7c
SHA256

2fec48e7d7433bf514db35fcafa55ed1516b5c7e458663c4faa0c8bd309ddd8a
SHA512

08cc523acf33b0d84d006ab2c17431fce475989ecd7c836af7f8dd13c229c3e1dbf669cfa14ecde69dc6b52ef71e100cfeb31584df379b56437967b64190d0bb
SSDEEP

1536:14R9KzUD5X66zFOa2INL0U/zDDiGPsMI7MPeDm5ER:2KzAXXzFt2INJ/4MPuq2

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2088	xpafoav-epom.exe

Loads dropped DLL 1 IoCs

pid	Process
2012	2fec48e7d7433bf514db35fcafa55ed1516b5c7e458663c4faa0c8bd309ddd8a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\xpafoav-epom.exe	2fec48e7d7433bf514db35fcafa55ed1516b5c7e458663c4faa0c8bd309ddd8a.exe
File created	C:\Windows\SysWOW64\xpafoav-epom.exe	2fec48e7d7433bf514db35fcafa55ed1516b5c7e458663c4faa0c8bd309ddd8a.exe

C:\Users\Admin\AppData\Local\Temp\2fec48e7d7433bf514db35fcafa55ed1516b5c7e458663c4faa0c8bd309ddd8a.exe
"C:\Users\Admin\AppData\Local\Temp\2fec48e7d7433bf514db35fcafa55ed1516b5c7e458663c4faa0c8bd309ddd8a.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:2012
- C:\Windows\SysWOW64\xpafoav-epom.exe
  "C:\Windows\SysWOW64\xpafoav-epom.exe"
  2⤵
  - Executes dropped EXE
  PID:2088

\Windows\SysWOW64\xpafoav-epom.exe

Filesize
70KB

MD5
6f83422003f8068a1e7fbf500a208d7c

SHA1
333f61cf5abd3b4bf45579e8c80c8ce1548c9c09

SHA256
94fe21be5b9b5ffa649dfdad013a3ded1084f7742ba28b9cce54e0b7aa6b4bf5

SHA512
3098649f1dc8b8916b002f5718f264cfa39cecc51f605be214b26cd43edece2778d2019cd6d75947e7b9dad8b102ecf2e44c73f1bba2feff6d4a3c73de7de98f

Download Submit
memory/2012-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download