0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a

Analysis

max time kernel
162s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:46

Target

0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe
Size

3.1MB
MD5

d81320cd418dbe42aacf308607347ec8
SHA1

3189453a28c49ec89addc8785a1fc0d7b3240916
SHA256

0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a
SHA512

82bee1e7afa1abeca09823e10c8f002d41faba753429e00b2a49123fb552c7bdf6b87a4ce61aab96dcf207c6f2e385329726cbda897dfe5d49d40c3a5dc305cb
SSDEEP

49152:P9hXDAkIZWnZDWCLW6tVlaqr2aV0KFvLHqgvkubUcPT8CX13eIOA1UGLuzoxp9/v:1hTAnQnZaCbFr2SPvugMuJPT8W13lIoT

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp

pid process

2260 0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
2260	0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe

description	pid	process	target process
PID 4404 wrote to memory of 2260	4404	0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe	0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp
PID 4404 wrote to memory of 2260	4404	0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe	0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp
PID 4404 wrote to memory of 2260	4404	0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe	0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp

C:\Users\Admin\AppData\Local\Temp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe
"C:\Users\Admin\AppData\Local\Temp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4404

C:\Users\Admin\AppData\Local\Temp\is-TNNAM.tmp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp
"C:\Users\Admin\AppData\Local\Temp\is-TNNAM.tmp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp" /SL5="$B0052,2987795,56832,C:\Users\Admin\AppData\Local\Temp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.exe"
2⤵
- Executes dropped EXE
PID:2260

C:\Users\Admin\AppData\Local\Temp\is-TNNAM.tmp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp
Filesize
693KB

MD5
bad7df2b3f5e2bdaf7c818b336d04c07

SHA1
4a7b408980f60d5f55939474481991673d1eca90

SHA256
741b1212ab966ab11965c7401c46568839a8f806a3860f10ee3525ce5eab152c

SHA512
e543d9686c89b584fc612d0b6356f8ed4650ff19b08c6f2e7367b5d9ace6ff9e6d9e35ecd1b589b252beba3425819517c58649003031c50de34a67dba24195e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TNNAM.tmp\0b37fe4ca10140de4fd1a6c9b00f2ab99dab85ec72a1091da158f8cbd18a7a4a.tmp
Filesize
693KB

MD5
bad7df2b3f5e2bdaf7c818b336d04c07

SHA1
4a7b408980f60d5f55939474481991673d1eca90

SHA256
741b1212ab966ab11965c7401c46568839a8f806a3860f10ee3525ce5eab152c

SHA512
e543d9686c89b584fc612d0b6356f8ed4650ff19b08c6f2e7367b5d9ace6ff9e6d9e35ecd1b589b252beba3425819517c58649003031c50de34a67dba24195e6

Download Submit
memory/2260-134-0x0000000000000000-mapping.dmp

Download
memory/4404-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4404-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4404-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download