aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 22:09

Target

aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe
Size

1.9MB
MD5

7f8eb66554dd21b6cd3841dac7ed558c
SHA1

88aabf681c83823fc4f88903c401c0a2acce566f
SHA256

aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed
SHA512

911f1863d0df323b7c8d7b07cfd2f20fd3939403c02a3d04dc988faee028e4b7c75f33d44fad95a87e6dc76111755cb2a197b1376a7703cf1867f6fa833026ec
SSDEEP

49152:dy8a7aZkQu/TR+oaPttRFUWc0CHrQC5x5IvwP1wRFJ1aU:odmZgV+lP9uWc0CQC5x5IuC1R

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3440	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3440	4664	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe	80
PID 4664 wrote to memory of 3440	4664	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe	80
PID 4664 wrote to memory of 3440	4664	aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe	80

C:\Users\Admin\AppData\Local\Temp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe
"C:\Users\Admin\AppData\Local\Temp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\is-9Q5J6.tmp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9Q5J6.tmp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.tmp" /SL5="$801C4,1718962,58368,C:\Users\Admin\AppData\Local\Temp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.exe"
  2⤵
  - Executes dropped EXE
  PID:3440

C:\Users\Admin\AppData\Local\Temp\is-9Q5J6.tmp\aaf8106dd83f758661ddf4f9fb7a7f45118016c61ab45673aa0f80c8a1097bed.tmp

Filesize
702KB

MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
memory/4664-132-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4664-136-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4664-137-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download