3dcfe090f85510f09af4e93085e79c9fc025a1a62bf818b95b842165af2acd2a

Analysis

max time kernel
186s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:59

Target

3dcfe090f85510f09af4e93085e79c9fc025a1a62bf818b95b842165af2acd2a.exe
Size

49KB
MD5

f2917a2ba4244bbc0a9947320e878d84
SHA1

23eeb106a77661a6e7127ce6b27e71355da4e3b9
SHA256

3dcfe090f85510f09af4e93085e79c9fc025a1a62bf818b95b842165af2acd2a
SHA512

0a0a4f4361b258ecdc67e0f2f8381ff22de7ab47f7a345e1c77b7fd94a43ca3ce0e3f7f1ca6b875c8b555311c699eee7ee47b82ea258a532a7d3168b61155819
SSDEEP

768:ZdJfVGW99wXkf0x7lSStPRe/MGnGolWtpXFULi:ZdJdpxfecStPR0Tktk

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

1973.tmp

pid process

2580 1973.tmp

pid	process
2580	1973.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3dcfe090f85510f09af4e93085e79c9fc025a1a62bf818b95b842165af2acd2a.exe

description	pid	process	target process
PID 2388 wrote to memory of 2580	2388	3dcfe090f85510f09af4e93085e79c9fc025a1a62bf818b95b842165af2acd2a.exe	1973.tmp
PID 2388 wrote to memory of 2580	2388	3dcfe090f85510f09af4e93085e79c9fc025a1a62bf818b95b842165af2acd2a.exe	1973.tmp
PID 2388 wrote to memory of 2580	2388	3dcfe090f85510f09af4e93085e79c9fc025a1a62bf818b95b842165af2acd2a.exe	1973.tmp

C:\Users\Admin\AppData\Local\Temp\3dcfe090f85510f09af4e93085e79c9fc025a1a62bf818b95b842165af2acd2a.exe
"C:\Users\Admin\AppData\Local\Temp\3dcfe090f85510f09af4e93085e79c9fc025a1a62bf818b95b842165af2acd2a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388

C:\Users\Admin\AppData\Local\Temp\1973.tmp
"C:\Users\Admin\AppData\Local\Temp\1973.tmp" "C:\Users\Admin\AppData\Local\Temp\3DCFE0~1.EXE"
2⤵
- Executes dropped EXE
PID:2580

C:\Users\Admin\AppData\Local\Temp\1973.tmp

Filesize
49KB

MD5
f2917a2ba4244bbc0a9947320e878d84

SHA1
23eeb106a77661a6e7127ce6b27e71355da4e3b9

SHA256
3dcfe090f85510f09af4e93085e79c9fc025a1a62bf818b95b842165af2acd2a

SHA512
0a0a4f4361b258ecdc67e0f2f8381ff22de7ab47f7a345e1c77b7fd94a43ca3ce0e3f7f1ca6b875c8b555311c699eee7ee47b82ea258a532a7d3168b61155819

Download Submit
C:\Users\Admin\AppData\Local\Temp\1973.tmp

Filesize
49KB

MD5
f2917a2ba4244bbc0a9947320e878d84

SHA1
23eeb106a77661a6e7127ce6b27e71355da4e3b9

SHA256
3dcfe090f85510f09af4e93085e79c9fc025a1a62bf818b95b842165af2acd2a

SHA512
0a0a4f4361b258ecdc67e0f2f8381ff22de7ab47f7a345e1c77b7fd94a43ca3ce0e3f7f1ca6b875c8b555311c699eee7ee47b82ea258a532a7d3168b61155819

Download Submit
memory/2388-132-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2388-137-0x00000000007A0000-0x00000000007B9000-memory.dmp

Filesize
100KB

Download
memory/2580-133-0x0000000000000000-mapping.dmp

Download
memory/2580-138-0x0000000000890000-0x000000000094F000-memory.dmp

Filesize
764KB

Download
memory/2580-139-0x0000000000890000-0x000000000094F000-memory.dmp

Filesize
764KB

Download