3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097

Analysis

max time kernel
185s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 21:01

Target

3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097.exe
Size

16.1MB
MD5

9d6029877055eb07cb14b154ba74278a
SHA1

6de18194b50ae586fae3cba02dfccabfb8deb9ef
SHA256

3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097
SHA512

30cd996abf78ea117f24cdedec325360cdaf75e7b5a4cdaec3d6e3b0233eb0bfe4f2b3924cd4b6a6f3f5af1b4c5b2f3ba1673b5070aeadb6c1ca6b1a6b8ad882
SSDEEP

393216:9xvnjR/pvgCEF8JASqwzJYKZhaIteDcl9zfuFtdt:9tj15gnFcASqwBxt39zetX

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
5080	3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 5080	5060	3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097.exe	80
PID 5060 wrote to memory of 5080	5060	3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097.exe	80
PID 5060 wrote to memory of 5080	5060	3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097.exe	80

C:\Users\Admin\AppData\Local\Temp\3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097.exe
"C:\Users\Admin\AppData\Local\Temp\3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\is-RFTGU.tmp\3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RFTGU.tmp\3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097.tmp" /SL5="$501EC,16630065,73728,C:\Users\Admin\AppData\Local\Temp\3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097.exe"
  2⤵
  - Executes dropped EXE
  PID:5080

C:\Users\Admin\AppData\Local\Temp\is-RFTGU.tmp\3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097.tmp

Filesize
721KB

MD5
c86ded3ac45a4be958b7a07127a7f8e2

SHA1
5bd27746646d79e7d16e0a17b875a2d5464824e2

SHA256
41cdc2b13c2cf5d2bba5a75d7b85bb526c5fb1950bad0835ed59fe0ff30978b4

SHA512
01c74d17c16d36a6f50e8590ce4bf334427f0490f5d21bfa550f4930d278e748432640977c73841bf8fb1cf29a2eab16ef89f03588b0f2fcb7e28c8f8cff7249

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RFTGU.tmp\3cc50d975c715b1878fa7729aed14696709cb4961fb380fd6e1582ee6db80097.tmp

Filesize
721KB

MD5
c86ded3ac45a4be958b7a07127a7f8e2

SHA1
5bd27746646d79e7d16e0a17b875a2d5464824e2

SHA256
41cdc2b13c2cf5d2bba5a75d7b85bb526c5fb1950bad0835ed59fe0ff30978b4

SHA512
01c74d17c16d36a6f50e8590ce4bf334427f0490f5d21bfa550f4930d278e748432640977c73841bf8fb1cf29a2eab16ef89f03588b0f2fcb7e28c8f8cff7249

Download Submit
memory/5060-132-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5060-137-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download