95ebf269b7b7e6d405378005909448721dea4913b50311050efa01f3918e23dd

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 17:11

Target

95ebf269b7b7e6d405378005909448721dea4913b50311050efa01f3918e23dd.exe
Size

1.7MB
MD5

fc0e1016dc5c19a79fc243f70e02e97b
SHA1

eaed53daad8abdf7797c4e2abb9b1704c005f30d
SHA256

95ebf269b7b7e6d405378005909448721dea4913b50311050efa01f3918e23dd
SHA512

ecc5718ac82acccd2164a2d16a015e5cff7604746b588153c517fbf47d808ad3fb6361a309e381347ae5b350d5e9d5e105df183be388ae57b461b6817c3e4655
SSDEEP

24576:RXT2WAeDmpMfzekpIqiG96Hxm6GufE32CPQP2mV2SdNyLPcdg+A:RXT2cDMkgFA6W2wmV2SdNyzaA

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
17032	TomieWGM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2184	95ebf269b7b7e6d405378005909448721dea4913b50311050efa01f3918e23dd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 17032	2184	95ebf269b7b7e6d405378005909448721dea4913b50311050efa01f3918e23dd.exe	30
PID 2184 wrote to memory of 17032	2184	95ebf269b7b7e6d405378005909448721dea4913b50311050efa01f3918e23dd.exe	30
PID 2184 wrote to memory of 17032	2184	95ebf269b7b7e6d405378005909448721dea4913b50311050efa01f3918e23dd.exe	30
PID 2184 wrote to memory of 17032	2184	95ebf269b7b7e6d405378005909448721dea4913b50311050efa01f3918e23dd.exe	30

C:\Users\Admin\AppData\Local\Temp\95ebf269b7b7e6d405378005909448721dea4913b50311050efa01f3918e23dd.exe
"C:\Users\Admin\AppData\Local\Temp\95ebf269b7b7e6d405378005909448721dea4913b50311050efa01f3918e23dd.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\TomieWGM.exe
  "C:\Users\Admin\AppData\Local\Temp\TomieWGM.exe"
  2⤵
  - Executes dropped EXE
  PID:17032

C:\Users\Admin\AppData\Local\Temp\TomieWGM.exe

Filesize
625KB

MD5
096db5c5c66072ed827b3e4c4b817ac0

SHA1
7f5a4ead85aab0a5074bdfc16f887dffbf3cbcf8

SHA256
c5446dcfd3ca3c9a21524f60faf38d38e040a22c0e561bd071dba56f43d76ebf

SHA512
9b0695f4bee4427802737cdc08730332ef03b13044407a1ffbc726af3f6215511f9c64bf14ba4068c781e9bd2c087f7548f93478368fdc435bb1857bc1699697

Download Submit
memory/2184-0-0x00000000002F0000-0x0000000000395000-memory.dmp

Filesize
660KB

Download
memory/2184-6-0x00000000002F0000-0x0000000000395000-memory.dmp

Filesize
660KB

Download
memory/2184-7-0x00000000003A0000-0x00000000003A5000-memory.dmp

Filesize
20KB

Download