bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4

Analysis

max time kernel
152s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 05:13

Target

bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe
Size

664KB
MD5

362115cb5a09aca821507856e9103cc1
SHA1

08f6fdc011fc845aa031b61786dc98ae411a7219
SHA256

bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4
SHA512

d9267679a9c263eeafd9b5930ea8dca2f0e7b53c26a1857e45ab10a0c4aa922a3d53f84a9188b076f3afcb7b5c19b5883fa9f43fd0ec4826bfa7c0b46b215c5f
SSDEEP

12288:h6Qyv5+vt/2z9olD6669/M+l6nRSciC1qfyI2stDzZ6JvEl+UgKsXBeGdnbH:hO5+v4olDK9/M/PhqV2+Z6JvJVKYeGdr

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2688	~DFA234.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2688	4964	bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe	80
PID 4964 wrote to memory of 2688	4964	bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe	80
PID 4964 wrote to memory of 2688	4964	bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe	80

C:\Users\Admin\AppData\Local\Temp\bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe
"C:\Users\Admin\AppData\Local\Temp\bb4cbc35e4454479986118d82f849b3b39b3511db1c3809aba126c17810571a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Users\Admin\AppData\Local\Temp\~DFA234.tmp
  C:\Users\Admin\AppData\Local\Temp\~DFA234.tmp OK
  2⤵
  - Executes dropped EXE
  PID:2688

C:\Users\Admin\AppData\Local\Temp\~DFA234.tmp

Filesize
668KB

MD5
65e0e09c50d96b3e39cebaece2a52602

SHA1
5dd594be866f964c26cdca85f76c6f13a2508afb

SHA256
a5c6ca120b3a94900986e6dced634e19677e5ff263d57cf74c6670b4ac71327d

SHA512
612418fadd337fc52b5366d2c828533bbbeed06ba43426ba737fd5d250095ecbfb09998edf85b3a78bd9344cf79fc64805c3c6c98bdd992ae4fe96535751a52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFA234.tmp

Filesize
668KB

MD5
65e0e09c50d96b3e39cebaece2a52602

SHA1
5dd594be866f964c26cdca85f76c6f13a2508afb

SHA256
a5c6ca120b3a94900986e6dced634e19677e5ff263d57cf74c6670b4ac71327d

SHA512
612418fadd337fc52b5366d2c828533bbbeed06ba43426ba737fd5d250095ecbfb09998edf85b3a78bd9344cf79fc64805c3c6c98bdd992ae4fe96535751a52f

Download Submit
memory/2688-136-0x00000000006D0000-0x000000000078F000-memory.dmp

Filesize
764KB

Download
memory/2688-138-0x00000000006D0000-0x000000000078F000-memory.dmp

Filesize
764KB

Download
memory/4964-132-0x00000000009B0000-0x0000000000A6F000-memory.dmp

Filesize
764KB

Download
memory/4964-137-0x00000000009B0000-0x0000000000A6F000-memory.dmp

Filesize
764KB

Download