bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd

Analysis

max time kernel
88s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 06:24

Target

bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe
Size

73KB
MD5

a90251f5d9afcf62d3288d6b6d35f754
SHA1

dc4fdec28bb25bee51d3e425c828e02b3fa57337
SHA256

bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd
SHA512

4581e55f1b230ea088d83d7b6b340e15f70951e5a391d0a40beda5b664d9e9e1fd35d5581df23a97f86ccefde9e1e6d162d46fabce44a713753a6b6911a542f3
SSDEEP

1536:Hbws74jztoWoiK5QPqfhVWbdsmA+RjPFLC+e5he0ZGUGf2g:HQjJoViNPqfcxA+HFsheOg

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4908	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4312	2552	bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe	81
PID 2552 wrote to memory of 4312	2552	bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe	81
PID 2552 wrote to memory of 4312	2552	bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe	81
PID 4312 wrote to memory of 4908	4312	cmd.exe	82
PID 4312 wrote to memory of 4908	4312	cmd.exe	82
PID 4312 wrote to memory of 4908	4312	cmd.exe	82
PID 4908 wrote to memory of 4828	4908	[email protected]	83
PID 4908 wrote to memory of 4828	4908	[email protected]	83
PID 4908 wrote to memory of 4828	4908	[email protected]	83

C:\Users\Admin\AppData\Local\Temp\bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe
"C:\Users\Admin\AppData\Local\Temp\bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:4828

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
431e816a7ba834d75c05c7a039130b79

SHA1
04d3c83226544677f36a71e3e1df700cfda79429

SHA256
15bc3b2005450e1aafab1aad474fc50978458cae1593334334f89e847cfe3220

SHA512
ccf0c3844550640cab9abf9b3a5cf64b244fb460001c1afa9e2ad1035a2173e357746aa118434619f31f85a41b360f1c4e26c9b85aa4097cd221b598aba69135

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
431e816a7ba834d75c05c7a039130b79

SHA1
04d3c83226544677f36a71e3e1df700cfda79429

SHA256
15bc3b2005450e1aafab1aad474fc50978458cae1593334334f89e847cfe3220

SHA512
ccf0c3844550640cab9abf9b3a5cf64b244fb460001c1afa9e2ad1035a2173e357746aa118434619f31f85a41b360f1c4e26c9b85aa4097cd221b598aba69135

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit