38f9d5cf06fb29e62573079084e7261be304fbb44aa8c1bbb0b6b2c26e26270b

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 06:20

Target

38f9d5cf06fb29e62573079084e7261be304fbb44aa8c1bbb0b6b2c26e26270b.exe
Size

16KB
MD5

cd722e7b5b30490568d6343061c0136b
SHA1

1d324dbbf6d2e1c3a757ec8308b87480ed5c7820
SHA256

38f9d5cf06fb29e62573079084e7261be304fbb44aa8c1bbb0b6b2c26e26270b
SHA512

748a89d518f4cfa478564d5ab55747a0bef517eca9d52183d7e9d0e8d06389db072951c218e904b4364dcbef0c34855ca9f9ded4c6cb609f4f8caf2790e59077
SSDEEP

192:nrqehgiTktsoK29xNWj4Xg5hvOi7JtQzCdF4LUqIEyncjWO3L/CldolM/4/0gVar:nr3hgPX9xNWzh2iPjznoLCc4ZrX

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4148	DelFB8B.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	38f9d5cf06fb29e62573079084e7261be304fbb44aa8c1bbb0b6b2c26e26270b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 4148	3668	38f9d5cf06fb29e62573079084e7261be304fbb44aa8c1bbb0b6b2c26e26270b.exe	79
PID 3668 wrote to memory of 4148	3668	38f9d5cf06fb29e62573079084e7261be304fbb44aa8c1bbb0b6b2c26e26270b.exe	79
PID 3668 wrote to memory of 4148	3668	38f9d5cf06fb29e62573079084e7261be304fbb44aa8c1bbb0b6b2c26e26270b.exe	79

C:\Users\Admin\AppData\Local\Temp\38f9d5cf06fb29e62573079084e7261be304fbb44aa8c1bbb0b6b2c26e26270b.exe
"C:\Users\Admin\AppData\Local\Temp\38f9d5cf06fb29e62573079084e7261be304fbb44aa8c1bbb0b6b2c26e26270b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\DelFB8B.tmp
  "C:\Users\Admin\AppData\Local\Temp\DelFB8B.tmp" PID:1148 EXE:"C:\Users\Admin\AppData\Local\Temp\38f9d5cf06fb29e62573079084e7261be304fbb44aa8c1bbb0b6b2c26e26270b.exe"
  2⤵
  - Executes dropped EXE
  PID:4148

C:\Users\Admin\AppData\Local\Temp\DelFB8B.tmp

Filesize
16KB

MD5
cd722e7b5b30490568d6343061c0136b

SHA1
1d324dbbf6d2e1c3a757ec8308b87480ed5c7820

SHA256
38f9d5cf06fb29e62573079084e7261be304fbb44aa8c1bbb0b6b2c26e26270b

SHA512
748a89d518f4cfa478564d5ab55747a0bef517eca9d52183d7e9d0e8d06389db072951c218e904b4364dcbef0c34855ca9f9ded4c6cb609f4f8caf2790e59077

Download Submit
C:\Users\Admin\AppData\Local\Temp\DelFB8B.tmp

Filesize
16KB

MD5
cd722e7b5b30490568d6343061c0136b

SHA1
1d324dbbf6d2e1c3a757ec8308b87480ed5c7820

SHA256
38f9d5cf06fb29e62573079084e7261be304fbb44aa8c1bbb0b6b2c26e26270b

SHA512
748a89d518f4cfa478564d5ab55747a0bef517eca9d52183d7e9d0e8d06389db072951c218e904b4364dcbef0c34855ca9f9ded4c6cb609f4f8caf2790e59077

Download Submit
memory/3668-132-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3668-133-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4148-137-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download