159040dbcbd11e70b7cba12cff585331bb79a974698e44eac9da58f51d80b68d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:33

Target

159040dbcbd11e70b7cba12cff585331bb79a974698e44eac9da58f51d80b68d.exe
Size

61KB
MD5

1e08939e765b21ba128795f7a1d15c30
SHA1

db92940448e6466e2d6da5f43023815e4860acdd
SHA256

159040dbcbd11e70b7cba12cff585331bb79a974698e44eac9da58f51d80b68d
SHA512

9e0f50e4c0f5b8da1e28c389daa94ea9d9243cd51c4e4e0f2403ac34520756439c053dd5d3e66f5a3fe2146441cb15698d0569dee46ea7fde38a1139298dfa40
SSDEEP

1536:Nttdse4OcUmWQIvEPZo6E5sEFd29NQgA2wwle5:Fdse4OlQZo6EKEFdGM21le5

Score

7^/10

Executes dropped EXE 4 IoCs

Processes:

ewiuer2.exeewiuer2.exeewiuer2.exeewiuer2.exe

pid process

2760 ewiuer2.exe
4804 ewiuer2.exe
1912 ewiuer2.exe
3704 ewiuer2.exe

Drops file in System32 directory 4 IoCs

Processes:

ewiuer2.exeewiuer2.exeewiuer2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File opened for modification	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File opened for modification	C:\Windows\SysWOW64\viesazm.mpk	ewiuer2.exe
File created	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

159040dbcbd11e70b7cba12cff585331bb79a974698e44eac9da58f51d80b68d.exeewiuer2.exeewiuer2.exeewiuer2.exe

description	pid	process	target process
PID 4588 wrote to memory of 2760	4588	159040dbcbd11e70b7cba12cff585331bb79a974698e44eac9da58f51d80b68d.exe	ewiuer2.exe
PID 4588 wrote to memory of 2760	4588	159040dbcbd11e70b7cba12cff585331bb79a974698e44eac9da58f51d80b68d.exe	ewiuer2.exe
PID 4588 wrote to memory of 2760	4588	159040dbcbd11e70b7cba12cff585331bb79a974698e44eac9da58f51d80b68d.exe	ewiuer2.exe
PID 2760 wrote to memory of 4804	2760	ewiuer2.exe	ewiuer2.exe
PID 2760 wrote to memory of 4804	2760	ewiuer2.exe	ewiuer2.exe
PID 2760 wrote to memory of 4804	2760	ewiuer2.exe	ewiuer2.exe
PID 4804 wrote to memory of 1912	4804	ewiuer2.exe	ewiuer2.exe
PID 4804 wrote to memory of 1912	4804	ewiuer2.exe	ewiuer2.exe
PID 4804 wrote to memory of 1912	4804	ewiuer2.exe	ewiuer2.exe
PID 1912 wrote to memory of 3704	1912	ewiuer2.exe	ewiuer2.exe
PID 1912 wrote to memory of 3704	1912	ewiuer2.exe	ewiuer2.exe
PID 1912 wrote to memory of 3704	1912	ewiuer2.exe	ewiuer2.exe

C:\Users\Admin\AppData\Local\Temp\159040dbcbd11e70b7cba12cff585331bb79a974698e44eac9da58f51d80b68d.exe
"C:\Users\Admin\AppData\Local\Temp\159040dbcbd11e70b7cba12cff585331bb79a974698e44eac9da58f51d80b68d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588

C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Filesize
61KB

MD5
ff6b73fd2eefc24e617b306abaa1e3b5

SHA1
8448204595b0729f54cebd52a99ab1ada47f1cf8

SHA256
4aea54d0d6a139d1d6b4c29e2c9e0c0e503cb7beaab8666adec802c95e6668cf

SHA512
b9150709ad18cf51df238ac9dba768ee54deb100412f31124e74382f5e1cc1fba83884f329dd6cb1a52a4b72ed6432c33ccf9f15d0832af5ef5592bbac1b6274

Download Submit
C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Filesize
61KB

MD5
0b42de534248b4f8a403542c8f578b5d

SHA1
ccb313f42c4c847daa077e9a57510261d7231ecc

SHA256
67ff7d9fa1d9a6822cc1d70ed8b5a55d3ef8144225a62444c2b00cc6872c2f50

SHA512
125ef62f0f5a87471b5611ef2d99e1febc7a35a55651d94e9ecd04059925c80db86a122c9ac41f79b00aede414559088aa8bb90ab1140662335ca6dd8d9698e4

Download Submit
C:\Windows\SysWOW64\ewiuer2.exe
Filesize
61KB

MD5
2ac68d7d0e26b6f639905e90a645ca8a

SHA1
689e85c01527d1f8879a11984b407362a47ab4e9

SHA256
4097e78865da9756a3558634e2536c68e6d81821d7be69099f886c01d706b9e4

SHA512
7ae1ebf573ea340f40f063aa05611301649947ee38a890237d8cf587c49dc4cfe77d1e6f87a128f1c1fdf20707edd0256dcb9f725013ddb53ad2e6a6d333d014

Download Submit
C:\Windows\SysWOW64\ewiuer2.exe
Filesize
61KB

MD5
822f71cc15991e6792d242490869641e

SHA1
5cc41a05b9f77b5a479a31c2530994b6ed696a91

SHA256
5ac28cedc1a30ea6225551e42b4f57d8f8a090e382df9c072e4875a1d4f189a3

SHA512
889010021a4220ee6c1b97c1a627f4422cb7b8261961b74dc247bbb58bdb452fc2ef386df45deb80c1f718b8326461f5bf467ec0019489f98bc3725c43c3d146

Download Submit