b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 12:12

Target

b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe
Size

73KB
MD5

9381260b3dcc650882b530e394de4800
SHA1

8d4a541dc99303aaf25fc53d87b30275f3604949
SHA256

b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a
SHA512

fadad9eeb24180231b7070b7ad15b3fce8f540cffca0fc6680a7efe4ec87686b857ee8dbc47442c6489f3480aee581c9e6d1a91f3ab34e1eeb2aadfb653d4afd
SSDEEP

1536:HbmbLgS+hK5QPqfhVWbdsmA+RjPFLC+e5hF0ZGUGf2g:HwgS+hNPqfcxA+HFshFOg

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2892	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 580	4684	b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe	84
PID 4684 wrote to memory of 580	4684	b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe	84
PID 4684 wrote to memory of 580	4684	b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe	84
PID 580 wrote to memory of 2892	580	cmd.exe	85
PID 580 wrote to memory of 2892	580	cmd.exe	85
PID 580 wrote to memory of 2892	580	cmd.exe	85
PID 2892 wrote to memory of 1504	2892	[email protected]	86
PID 2892 wrote to memory of 1504	2892	[email protected]	86
PID 2892 wrote to memory of 1504	2892	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe
"C:\Users\Admin\AppData\Local\Temp\b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1504

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
b0dfef1c352488726b317bb421501a39

SHA1
bfb9840c5f1806f1027184add0b6a8bcbc04cd79

SHA256
8024633d989ba71cc98e3716be64997904e062939675179d5c185cd85a8a8272

SHA512
5127877435b9ccef2287b8ff29bfc9ac3a5d8693ff6fe91cbf82c4938141daa53202530ba04a191ac74746d3c2602bbb2a2d868e0521eae349eb3512455b336b

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
b0dfef1c352488726b317bb421501a39

SHA1
bfb9840c5f1806f1027184add0b6a8bcbc04cd79

SHA256
8024633d989ba71cc98e3716be64997904e062939675179d5c185cd85a8a8272

SHA512
5127877435b9ccef2287b8ff29bfc9ac3a5d8693ff6fe91cbf82c4938141daa53202530ba04a191ac74746d3c2602bbb2a2d868e0521eae349eb3512455b336b

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit