88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 15:41

Target

88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81.exe
Size

52.3MB
MD5

a823ae13abd826c19673dc32a25dc451
SHA1

86f6ffd154d3a62619c2738c89611e74970fde62
SHA256

88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81
SHA512

195ac305000be5061430dccd7fc48004c585d3aab8173f9e326f6f7c934df33afc4a3bedf36bfa69dace88de974fb54b59d25f288b69cd6570aa2fb28f9216dd
SSDEEP

786432:GGybxLpBANYzzCc+asN9yIt8bxrrIOnRwQjrxPX8bM6lw7iNIHXPR1SgfOtXlo94:3yb62zCzN9yIQ2CrtX8wZ7mAXpTSqvjW

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2224	88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2224	2060	88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81.exe	81
PID 2060 wrote to memory of 2224	2060	88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81.exe	81
PID 2060 wrote to memory of 2224	2060	88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81.exe	81

C:\Users\Admin\AppData\Local\Temp\88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81.exe
"C:\Users\Admin\AppData\Local\Temp\88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\is-NIKVD.tmp\88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NIKVD.tmp\88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81.tmp" /SL5="$801BC,53967374,731136,C:\Users\Admin\AppData\Local\Temp\88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81.exe"
  2⤵
  - Executes dropped EXE
  PID:2224

C:\Users\Admin\AppData\Local\Temp\is-NIKVD.tmp\88be05241c4ab4592e698020883df2f17e9264123c7117817c9873e11f0bfc81.tmp

Filesize
2.9MB

MD5
dc4ef321ca52b078370317b604cf2bdf

SHA1
ef168a0ffd11d6a74215def807f126d6c38a1a58

SHA256
2e0edff2fd83211afdfd69192085e994f8180c368d41f36e54711e9f085f18f9

SHA512
9cdce191e8b235af9d89bf6e2c46131f918f518545f9f49be501adf05820b4c91472b5c64468a0db280e30be04e356d88f60dad1d1975ba3c9a8c3a2c9775d39

Download Submit
memory/2060-132-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2060-134-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2060-137-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download