fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 18:25

Target

fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff.exe
Size

11.2MB
MD5

3a9ce77f2597b3af42e6849dd333d7ea
SHA1

35766b454d497770777ee77c01a80a2a70f82c14
SHA256

fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff
SHA512

a55c236ec76df950ea2662c2c098cdf71028e3c476f3246b414621024b42bcfb9362bdb9a2949a5186ac00dea2f82751d0231e54c22158117969b0b711493550
SSDEEP

196608:E4vfHAXsmsSYu/hVRjhiKLiAbID5/xpi4DE5hA+bN7X+LxX2wma/W+wG4upN0nhV:AsIYkEj845Y4DE5FbaxXZhwG4rhPt

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1696	fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1696	2156	fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff.exe	82
PID 2156 wrote to memory of 1696	2156	fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff.exe	82
PID 2156 wrote to memory of 1696	2156	fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff.exe	82

C:\Users\Admin\AppData\Local\Temp\fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff.exe
"C:\Users\Admin\AppData\Local\Temp\fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\is-2EPRN.tmp\fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2EPRN.tmp\fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff.tmp" /SL5="$801D8,11481830,54272,C:\Users\Admin\AppData\Local\Temp\fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff.exe"
  2⤵
  - Executes dropped EXE
  PID:1696

C:\Users\Admin\AppData\Local\Temp\is-2EPRN.tmp\fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff.tmp

Filesize
721KB

MD5
69071ca28edf4a98aef4c7fa7a3f9bb7

SHA1
a6dd33c57a6ee2814cd03a6797cd88b779403bac

SHA256
ffeee602b8802816ce523b6cc09263804d4452e50abcbaef484cc0eef9b0c417

SHA512
cea1b595947ede1555c077c0e3f61cb1fc68f4d1c58ac0cdd6b220dfda83407452215e0bf6ad4c661294e788e297ee40bfaa5e2f1a9bcedd78a12e357642fa71

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2EPRN.tmp\fac52aed390e5455591ec8830f19fd6f2c97d302700d1bfe0b423d3c66e548ff.tmp

Filesize
721KB

MD5
69071ca28edf4a98aef4c7fa7a3f9bb7

SHA1
a6dd33c57a6ee2814cd03a6797cd88b779403bac

SHA256
ffeee602b8802816ce523b6cc09263804d4452e50abcbaef484cc0eef9b0c417

SHA512
cea1b595947ede1555c077c0e3f61cb1fc68f4d1c58ac0cdd6b220dfda83407452215e0bf6ad4c661294e788e297ee40bfaa5e2f1a9bcedd78a12e357642fa71

Download Submit
memory/2156-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2156-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2156-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download