b2a932f7acca3a7c7835b38e56aad805e025fa9f8208355830e51cbc396300fe

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 23:05

Target

b2a932f7acca3a7c7835b38e56aad805e025fa9f8208355830e51cbc396300fe.exe
Size

306KB
MD5

44cfe38b1a6058a6c2969ada20a50a76
SHA1

a280a3ae49df85b89a2f2c97bd4455670a89e282
SHA256

b2a932f7acca3a7c7835b38e56aad805e025fa9f8208355830e51cbc396300fe
SHA512

ac354cfcf15d7e4436a41ac7def725b16527b5991c2b60d159d0f802aeeac8774702f45a005fdf2471d94cdba52513ecd27e0073624169eeaecc1ab4ac7e1c53
SSDEEP

6144:TKERrJtYAbUmkUNKWqHkt5ZqQmnIiKUstTMKRtfFtcxdXujZDeHmO52:TKE7myUmkaK4tfpmIJwE5zcxd+Fs2

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
616	slo67A8.tmp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 616	3356	b2a932f7acca3a7c7835b38e56aad805e025fa9f8208355830e51cbc396300fe.exe	81
PID 3356 wrote to memory of 616	3356	b2a932f7acca3a7c7835b38e56aad805e025fa9f8208355830e51cbc396300fe.exe	81
PID 3356 wrote to memory of 616	3356	b2a932f7acca3a7c7835b38e56aad805e025fa9f8208355830e51cbc396300fe.exe	81

C:\Users\Admin\AppData\Local\Temp\b2a932f7acca3a7c7835b38e56aad805e025fa9f8208355830e51cbc396300fe.exe
"C:\Users\Admin\AppData\Local\Temp\b2a932f7acca3a7c7835b38e56aad805e025fa9f8208355830e51cbc396300fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\Temp\slo67A8.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\b2a932f7acca3a7c7835b38e56aad805e025fa9f8208355830e51cbc396300fe.exe"
  2⤵
  - Executes dropped EXE
  PID:616

C:\Users\Admin\AppData\Local\Temp\slo67A8.tmp.exe

Filesize
2KB

MD5
252087ad3def1ce980203a57947bdd97

SHA1
f216eabda34ecb66328b083c56ca9b8a037e2e73

SHA256
f17cb71f7188335c3c30c1400e5f8127b2cc152c67a61e955e16de5f6612ee0a

SHA512
26325a9a36317f667e2643b0af987706a57fd10849be11c22f1f4ed2b8242c1c4de1b44f5ee83102a092e7f2a55163c3eb56989a60980a17259c322998644d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\slo67A8.tmp.exe

Filesize
2KB

MD5
252087ad3def1ce980203a57947bdd97

SHA1
f216eabda34ecb66328b083c56ca9b8a037e2e73

SHA256
f17cb71f7188335c3c30c1400e5f8127b2cc152c67a61e955e16de5f6612ee0a

SHA512
26325a9a36317f667e2643b0af987706a57fd10849be11c22f1f4ed2b8242c1c4de1b44f5ee83102a092e7f2a55163c3eb56989a60980a17259c322998644d4c

Download Submit
memory/616-132-0x0000000000000000-mapping.dmp

Download
memory/3356-135-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download