400debff42246bcf28d1eba937480ebdfa755c932707db10ab58ec4a1f5e94f1

Resubmissions

10-11-2021 14:52

09-11-2021 13:19

Target

78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.exe
Size

504KB
MD5

7f1faa8a4ddb32af19428f462da72136
SHA1

c7dea48daab84594fa0138542c274e8e9ce1fedf
SHA256

78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd
SHA512

f8a4c204224d200f326f7782e4b1024cd2745631727f948eb7904267113d062a0f34d1b53b6b972e0dbf4f37e4e08b5b4b8e6878f3677100513fbf515ef84057

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3124	78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.tmp

Loads dropped DLL 1 IoCs

pid	Process
3124	78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 3124	1300	78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.exe	69
PID 1300 wrote to memory of 3124	1300	78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.exe	69
PID 1300 wrote to memory of 3124	1300	78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.exe	69

C:\Users\Admin\AppData\Local\Temp\78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.exe
"C:\Users\Admin\AppData\Local\Temp\78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\is-GRT8V.tmp\78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GRT8V.tmp\78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.tmp" /SL5="$601C0,247014,163328,C:\Users\Admin\AppData\Local\Temp\78a82aa6d47c01237be6b269d2bda88a9ca0b1e6eecc29ba631e18fbbd18e5cd.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3124

memory/1300-120-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3124-123-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download