b2989e35351b59cd09af94f5c34a219c62c3a9dadd916388e383b3cf1681784c

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 22:52

Target

1.exe
Size

675KB
MD5

a2c8cbb73fea7bb34c92911d840d5508
SHA1

19d30711500ddeb81f14dd920421b2e7d7ed8e52
SHA256

d1bb60fd0965793e028ae7035157079f7b6c79165b40d75e7cf37c95ff08e642
SHA512

1756774b8b4256e45710d736ef3c86c195618f172c4a1c7c75f2142599bf17660abb918a056bdc795b7103e6b219fec1b0bedc85e0ccb244007e26a44e3c5b9d
SSDEEP

12288:D3WwcUo888888888888W88888888888/6LjdjDk33NwSH+aF+vkvC5rtTk5KODWa:TPcj6LjFS9jF6kvCUIODWkUM

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1348	1.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1348	1192	1.exe	80
PID 1192 wrote to memory of 1348	1192	1.exe	80
PID 1192 wrote to memory of 1348	1192	1.exe	80

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\is-D6F3F.tmp\1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-D6F3F.tmp\1.tmp" /SL5="$A0066,141824,0,C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  PID:1348

C:\Users\Admin\AppData\Local\Temp\is-D6F3F.tmp\1.tmp

Filesize
1.1MB

MD5
c2200909c2dd2fb3557861390f120529

SHA1
5b7669a6e307eec66b3ef167f29735426024c150

SHA256
55775133ec1b33c4771b5fc3c5164b2db183d15349eada5d061b2cc53249dc9a

SHA512
bf794271a56161e4c8cd9497f5a1a10efe96ada4c69e9e55983c4178a73ef91f66f96aaca62996f945b0f3b0a4a10e2207a7856760c9b537d48cf5c2cb1aaac5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D6F3F.tmp\1.tmp

Filesize
1.1MB

MD5
c2200909c2dd2fb3557861390f120529

SHA1
5b7669a6e307eec66b3ef167f29735426024c150

SHA256
55775133ec1b33c4771b5fc3c5164b2db183d15349eada5d061b2cc53249dc9a

SHA512
bf794271a56161e4c8cd9497f5a1a10efe96ada4c69e9e55983c4178a73ef91f66f96aaca62996f945b0f3b0a4a10e2207a7856760c9b537d48cf5c2cb1aaac5

Download Submit
memory/1192-132-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1192-137-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1192-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1348-134-0x0000000000000000-mapping.dmp

Download