acfe35fbc39418fdd1bf10122f8a4e65dca7c035984856499b1ab18277a8c6a7

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 22:07

Target

zzxcQbq.exe
Size

154KB
MD5

341c10bdaacaf6ce8597010686e32774
SHA1

bd540adcc2c0a42d552c54a09d0deac5bc81268e
SHA256

8c960c48df52fd6aab7d06567b6b09c1bdad0b8c84b1e7fe1e70eefa3b91869c
SHA512

a8b3a1445c044f8aac97f248833a9fb303f60c9aa83f371f870a4cb17c4562afbe803f990608a20964c4bada42c1ea91100e66a4cee8409ae0a77d174cb46ddc
SSDEEP

3072:6RVim8g8jfIKdZY/VFhINLijAHoTC0fmxS9IAxzspOs:6yM8jFm/VrINL7G7CAm

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

zzxcQbq.exe

pid process

4820 zzxcQbq.exe
4820 zzxcQbq.exe
Suspicious behavior: LoadsDriver 64 IoCs

Processes:

pid

4
4
4
4
4
668
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4

pid	process
4820	zzxcQbq.exe
4820	zzxcQbq.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

zzxcQbq.exe

description	pid	process	target process
PID 4820 wrote to memory of 4208	4820	zzxcQbq.exe	zzxcQbq.exe
PID 4820 wrote to memory of 4208	4820	zzxcQbq.exe	zzxcQbq.exe
PID 4820 wrote to memory of 4208	4820	zzxcQbq.exe	zzxcQbq.exe

C:\Users\Admin\AppData\Local\Temp\zzxcQbq.exe
"C:\Users\Admin\AppData\Local\Temp\zzxcQbq.exe"
2⤵
PID:4208

memory/4820-4-0x00000000005F0000-0x0000000000607000-memory.dmp

Filesize
92KB

Download
memory/4820-0-0x00000000005F0000-0x0000000000607000-memory.dmp

Filesize
92KB

Download
memory/4820-6-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/4820-5-0x0000000000520000-0x0000000000537000-memory.dmp

Filesize
92KB

Download
memory/4820-7-0x0000000000520000-0x0000000000537000-memory.dmp

Filesize
92KB

Download