b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517

Analysis

max time kernel
143s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 02:16

Target

b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe
Size

611KB
MD5

2d62bae0fb6c97273904ec6b7ae3bb80
SHA1

d3fbdd09c91d6b5ab079496970795f80e16b6700
SHA256

b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517
SHA512

46c7594ac99f6127d6c57d7d35247999c7b387d605f20ee5dabc22e2694f8f32a5475501a645a8836b1a864f52925540e4c1f691b10cfe6b30228842531a2f88
SSDEEP

12288:mEtDt+QFAYvL7+3uhyMNfAsLfozPCOZ/5hNeGX9UZPTjOpMZaBY/x4b7GE:LTdvvdBfAXTBhqt4MZaB3r

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1540	~DFA22F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1540	4980	b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe	81
PID 4980 wrote to memory of 1540	4980	b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe	81
PID 4980 wrote to memory of 1540	4980	b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe	81

C:\Users\Admin\AppData\Local\Temp\b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe
"C:\Users\Admin\AppData\Local\Temp\b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\~DFA22F.tmp
  C:\Users\Admin\AppData\Local\Temp\~DFA22F.tmp OK
  2⤵
  - Executes dropped EXE
  PID:1540

C:\Users\Admin\AppData\Local\Temp\~DFA22F.tmp

Filesize
620KB

MD5
85e123912dc2d9c2e8520bb5660456ad

SHA1
223cf599daacd67927234b24457f16f58dd583c4

SHA256
146e2051b1db36c8b0d7e5d5e7e7c2b747d82b476044fe05dc8b32bac1b827a6

SHA512
cb31c8e3ac200043c0903c2cb9ee6039ab2ce66949dbf551001ab9f6548890f8bbf0fceee09f83b66b3d7f45b61a87341a8ae4b9b712e2afe30ec181ba7f93ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFA22F.tmp

Filesize
620KB

MD5
85e123912dc2d9c2e8520bb5660456ad

SHA1
223cf599daacd67927234b24457f16f58dd583c4

SHA256
146e2051b1db36c8b0d7e5d5e7e7c2b747d82b476044fe05dc8b32bac1b827a6

SHA512
cb31c8e3ac200043c0903c2cb9ee6039ab2ce66949dbf551001ab9f6548890f8bbf0fceee09f83b66b3d7f45b61a87341a8ae4b9b712e2afe30ec181ba7f93ab

Download Submit
memory/1540-136-0x00000000006A0000-0x000000000075F000-memory.dmp

Filesize
764KB

Download
memory/4980-132-0x00000000002D0000-0x000000000038F000-memory.dmp

Filesize
764KB

Download
memory/4980-137-0x00000000002D0000-0x000000000038F000-memory.dmp

Filesize
764KB

Download