336e67354f5d1b934a8cbbef5698e68a46e757707d92da31e3152cd461d4fb8f

Analysis

max time kernel
364s
max time network
406s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 06:02

Target
file.exe
Size 2.2MB
Sample221127-grhfjshe7t
SHA256 336e67354f5d1b934a8cbbef5698e68a46e757707d92da31e3152cd461d4fb8f
MD5 11589ce372ddd4346582a64a31569fe1
SHA1 f5e5b238f79db4ca174bdfc2bd56d39164f6e9a7
SHA512 ac45db82207405c4ae8cd212ec6e42b71edcff14e8983f81773a0904059e79ab3437468faabf4baea0a39b599b00abff1bbf5fbc9188148a48f707f5d897cd30
SSDEEP 49152:IVKPsUgCCBPq++2rBVyJ6UTmhEQf/p5RmskeujE9AG5cyx:IgPs7BPPZrBIJ6UTa5/Xcyx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4724	is-CESL2.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 4724	1780	file.exe	82
PID 1780 wrote to memory of 4724	1780	file.exe	82
PID 1780 wrote to memory of 4724	1780	file.exe	82

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\is-C8OVC.tmp\is-CESL2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-C8OVC.tmp\is-CESL2.tmp" /SL4 $B0058 "C:\Users\Admin\AppData\Local\Temp\file.exe" 2037612 51712
  2⤵
  - Executes dropped EXE
  PID:4724

is-CESL2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-C8OVC.tmp\is-CESL2.tmp
Size 643KB
SHA256 b5cd942dd7019c1cda1715e4ce942094c41ad1e7bc7c5f63fe3ab7d97bc5a021
MD5 363a4d2aa5d6cf5cbb2267cccf0c4436
SHA1 a4cdb756698ed28f522956166a6292e9e309dd9c
SHA512 b5929be6e258a63557f376b50a40f6d465cbd372a88e7dcae7944faacb9181cd55873f52dee99cee2e3705596b3b55cb6f784db800f5a32f06e63b9ead3e7c70
SSDEEP 12288:Jh5UooqWolrP837JzHvA6izJgnnyFNmayiAZrv4xp:f5NoqWolrP837JzHvA6yknyWFxv4xp
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-CESL2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-C8OVC.tmp\is-CESL2.tmp
Size 643KB
SHA256 b5cd942dd7019c1cda1715e4ce942094c41ad1e7bc7c5f63fe3ab7d97bc5a021
MD5 363a4d2aa5d6cf5cbb2267cccf0c4436
SHA1 a4cdb756698ed28f522956166a6292e9e309dd9c
SHA512 b5929be6e258a63557f376b50a40f6d465cbd372a88e7dcae7944faacb9181cd55873f52dee99cee2e3705596b3b55cb6f784db800f5a32f06e63b9ead3e7c70
SSDEEP 12288:Jh5UooqWolrP837JzHvA6izJgnnyFNmayiAZrv4xp:f5NoqWolrP837JzHvA6yknyWFxv4xp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1780-132-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1780-137-0x0000000000400000-0x0000000000413000-memory.dmp

Download