cab666c1986a9d17efddaab226c0dbc635aec9636f1d86de12fa92b18ffe1064

Analysis

max time kernel
132s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 12:03

Target

cab666c1986a9d17efddaab226c0dbc635aec9636f1d86de12fa92b18ffe1064.exe
Size

73KB
MD5

9291898d0d14ceee30a0effa01b6c600
SHA1

9cb5e5bef6df50eeb3b64009dedcb9af27070989
SHA256

cab666c1986a9d17efddaab226c0dbc635aec9636f1d86de12fa92b18ffe1064
SHA512

2643338fe816f4fac4f925c3321d391fe9a2fa18604d2e7c8b72c93278d853c4c451df29583ae35122eb2d7630f03b97ea0ab127363999a997097f2b4421609b
SSDEEP

768:YEghzqXYg93HS+q4djxHBN+w25Q1KJFoelh2kKJ/rVYr6FivjuiprBp:Y4YgxHpd9HH+wmQwybrVpFivfp

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
5100	e566b71.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 5100	1748	cab666c1986a9d17efddaab226c0dbc635aec9636f1d86de12fa92b18ffe1064.exe	82
PID 1748 wrote to memory of 5100	1748	cab666c1986a9d17efddaab226c0dbc635aec9636f1d86de12fa92b18ffe1064.exe	82
PID 1748 wrote to memory of 5100	1748	cab666c1986a9d17efddaab226c0dbc635aec9636f1d86de12fa92b18ffe1064.exe	82

C:\Users\Admin\AppData\Local\Temp\cab666c1986a9d17efddaab226c0dbc635aec9636f1d86de12fa92b18ffe1064.exe
"C:\Users\Admin\AppData\Local\Temp\cab666c1986a9d17efddaab226c0dbc635aec9636f1d86de12fa92b18ffe1064.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Local\Temp\e566b71.tmp
  >C:\Users\Admin\AppData\Local\Temp\cab666c1986a9d17efddaab226c0dbc635aec9636f1d86de12fa92b18ffe1064.exe
  2⤵
  - Executes dropped EXE
  PID:5100

C:\Users\Admin\AppData\Local\Temp\e566b71.tmp

Filesize
73KB

MD5
9291898d0d14ceee30a0effa01b6c600

SHA1
9cb5e5bef6df50eeb3b64009dedcb9af27070989

SHA256
cab666c1986a9d17efddaab226c0dbc635aec9636f1d86de12fa92b18ffe1064

SHA512
2643338fe816f4fac4f925c3321d391fe9a2fa18604d2e7c8b72c93278d853c4c451df29583ae35122eb2d7630f03b97ea0ab127363999a997097f2b4421609b

Download Submit
C:\Users\Admin\AppData\Local\Temp\e566b71.tmp

Filesize
73KB

MD5
9291898d0d14ceee30a0effa01b6c600

SHA1
9cb5e5bef6df50eeb3b64009dedcb9af27070989

SHA256
cab666c1986a9d17efddaab226c0dbc635aec9636f1d86de12fa92b18ffe1064

SHA512
2643338fe816f4fac4f925c3321d391fe9a2fa18604d2e7c8b72c93278d853c4c451df29583ae35122eb2d7630f03b97ea0ab127363999a997097f2b4421609b

Download Submit
memory/1748-132-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download