0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244

Analysis

max time kernel
74s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 13:57

Target

0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe
Size

718KB
MD5

6db49865cc60bc1584d133405a55e679
SHA1

ac23d03fdd584246417afe995e85ed75dfc54f2a
SHA256

0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244
SHA512

cc8da9227016c9623ca616e06a20d4a4aa550c93f0962ee1d2d0795e9410eb01ba7bb104fa308ecdf81c70aef1559aabe6689ee10fdebaaf17c8a7e3ced41623
SSDEEP

12288:7YdHz7oZV2j5W2Q6Y2BVQ428W+vqWt0S9SiPYZZz1SHU1vOjYt/8DIhd7OHYdHz:7e7QwtWeBVl2b+vhOUpkpSHU1r/eIhdn

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3660	~DFA235.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 3660	476	0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe	40
PID 476 wrote to memory of 3660	476	0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe	40
PID 476 wrote to memory of 3660	476	0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe	40

C:\Users\Admin\AppData\Local\Temp\0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe
"C:\Users\Admin\AppData\Local\Temp\0ff41109cc4819d921969725f9a23947be71bfe1ed3c0e798e7987d24ee55244.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:476
- C:\Users\Admin\AppData\Local\Temp\~DFA235.tmp
  C:\Users\Admin\AppData\Local\Temp\~DFA235.tmp OK
  2⤵
  - Executes dropped EXE
  PID:3660

C:\Users\Admin\AppData\Local\Temp\~DFA235.tmp

Filesize
724KB

MD5
b8bc7511dbc80c4a2280d435d22aafa9

SHA1
e7141d5af36230837388668c83087430806dcf30

SHA256
c6f7929486f54fa7c47b2bda44370dfe99cf00f78321cc896e859b7060ae7d0f

SHA512
a105375e5423d8dececd910c7666b405be510043686a21f60111a0fb043b12b1f9e00de15097eba0690b3bd0975718f059dd40156495a91f07024b8e37b39571

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFA235.tmp

Filesize
724KB

MD5
b8bc7511dbc80c4a2280d435d22aafa9

SHA1
e7141d5af36230837388668c83087430806dcf30

SHA256
c6f7929486f54fa7c47b2bda44370dfe99cf00f78321cc896e859b7060ae7d0f

SHA512
a105375e5423d8dececd910c7666b405be510043686a21f60111a0fb043b12b1f9e00de15097eba0690b3bd0975718f059dd40156495a91f07024b8e37b39571

Download Submit
memory/476-135-0x0000000000FA0000-0x0000000001067000-memory.dmp

Filesize
796KB

Download
memory/476-138-0x0000000000FA0000-0x0000000001067000-memory.dmp

Filesize
796KB

Download
memory/3660-136-0x0000000000AA0000-0x0000000000B67000-memory.dmp

Filesize
796KB

Download
memory/3660-137-0x0000000000AA0000-0x0000000000B67000-memory.dmp

Filesize
796KB

Download