af743dd26941b7af0b2323199c0dd0f54a0d42bc3f8d5b507d91666f1c5cc24e

Analysis

max time kernel
121s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 19:43

Target

af743dd26941b7af0b2323199c0dd0f54a0d42bc3f8d5b507d91666f1c5cc24e.exe
Size

73KB
MD5

79155999f67edfb7224d8a03dfe294c5
SHA1

914a50f8f01b9c4ecb8c542166a1a1c2a96f12d3
SHA256

af743dd26941b7af0b2323199c0dd0f54a0d42bc3f8d5b507d91666f1c5cc24e
SHA512

08bf76e0a1b4c50a9f903881732effc34a14b8a22c0af7469096995f85e0e856e9f7ab89cd1a71a9888036fecb6574c74f31520f8aa70a2a80d0e8f78f0c93cd
SSDEEP

1536:HbB1UYK5QPqfhVWbdsmA+RjPFLC+e5hM0ZGUGf2g:Hl1ZNPqfcxA+HFshMOg

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2164	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2976	1604	af743dd26941b7af0b2323199c0dd0f54a0d42bc3f8d5b507d91666f1c5cc24e.exe	84
PID 1604 wrote to memory of 2976	1604	af743dd26941b7af0b2323199c0dd0f54a0d42bc3f8d5b507d91666f1c5cc24e.exe	84
PID 1604 wrote to memory of 2976	1604	af743dd26941b7af0b2323199c0dd0f54a0d42bc3f8d5b507d91666f1c5cc24e.exe	84
PID 2976 wrote to memory of 2164	2976	cmd.exe	85
PID 2976 wrote to memory of 2164	2976	cmd.exe	85
PID 2976 wrote to memory of 2164	2976	cmd.exe	85
PID 2164 wrote to memory of 2356	2164	[email protected]	86
PID 2164 wrote to memory of 2356	2164	[email protected]	86
PID 2164 wrote to memory of 2356	2164	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\af743dd26941b7af0b2323199c0dd0f54a0d42bc3f8d5b507d91666f1c5cc24e.exe
"C:\Users\Admin\AppData\Local\Temp\af743dd26941b7af0b2323199c0dd0f54a0d42bc3f8d5b507d91666f1c5cc24e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2356

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
4d1b5e9feb85b59a1239a51b2fd78ead

SHA1
8c4e7a9e9e6260075ed41de833fe0d6d53f598a2

SHA256
17194b295fbc56c2dac2fdc6acb86065fa1a70532f5e09b647c8f0750ba0e8a1

SHA512
701b6f21c49f531e09a6c3b7b1c9f1f921021d2be304a3a4dc2227ac88ecd55f156c1a27a2565ffb0f501b40e5cce23f700278abc901fca2e83eed4e6c7e806c

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
4d1b5e9feb85b59a1239a51b2fd78ead

SHA1
8c4e7a9e9e6260075ed41de833fe0d6d53f598a2

SHA256
17194b295fbc56c2dac2fdc6acb86065fa1a70532f5e09b647c8f0750ba0e8a1

SHA512
701b6f21c49f531e09a6c3b7b1c9f1f921021d2be304a3a4dc2227ac88ecd55f156c1a27a2565ffb0f501b40e5cce23f700278abc901fca2e83eed4e6c7e806c

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit