4e112bd430d0967855c1a2c95b093d4412ed2e4f9d40523e237e956e40402aa8

Analysis

max time kernel
480s
max time network
519s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 15:02

Target
file.exe
Size 2.4MB
Sample221207-sef8haad3x
SHA256 4e112bd430d0967855c1a2c95b093d4412ed2e4f9d40523e237e956e40402aa8
MD5 11f3f2a6e47fc993fe92bef26cd90d68
SHA1 1fdfec745bf9b13de9a1157541d7dc1de9418bc0
SHA512 810b95a9121d5d7e177ec23fb7bb7d01201749dd8a2622e0911b0334df0315bb5894ba2d25632360d75e405c2dbd4d9560e2fa55d52c3fc1306186fcdb0ca34c
SSDEEP 49152:S/SFb+pr+xhjNFUVUO9lvqfZDx9ADpQ+65KprHdwjNZwN41kd:S/S9+YDNFU6+vqfZdypx6grHdYNO
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1436	is-9VFJT.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 1436	4064	file.exe	80
PID 4064 wrote to memory of 1436	4064	file.exe	80
PID 4064 wrote to memory of 1436	4064	file.exe	80

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\is-VPQVT.tmp\is-9VFJT.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VPQVT.tmp\is-9VFJT.tmp" /SL4 $900E4 "C:\Users\Admin\AppData\Local\Temp\file.exe" 2252891 73728
  2⤵
  - Executes dropped EXE
  PID:1436

is-9VFJT.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-VPQVT.tmp\is-9VFJT.tmp
Size 665KB
SHA256 2a841ad3820292ff2ab96429635062d0984d0b221e8bd7650777a1c51043b722
MD5 21efb90aabcda42c1232f008bd66fd99
SHA1 563835721536bbd8310eb1dc2fa18966ddffff3d
SHA512 106432d5d58bd2f904cbb9f28771c7b95ccbdd7cdf506b190f5968dbf552ae4ed54cd2f46624ab47cc730c565b7d8d7de7cc51609540df05d0a46c932c20c36e
SSDEEP 12288:/h5UooqWolrP837JzHvA6izJgnnyFNmayiAZrvX4xO6:p5NoqWolrP837JzHvA6yknyWFxvoxO6
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-9VFJT.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-VPQVT.tmp\is-9VFJT.tmp
Size 665KB
SHA256 2a841ad3820292ff2ab96429635062d0984d0b221e8bd7650777a1c51043b722
MD5 21efb90aabcda42c1232f008bd66fd99
SHA1 563835721536bbd8310eb1dc2fa18966ddffff3d
SHA512 106432d5d58bd2f904cbb9f28771c7b95ccbdd7cdf506b190f5968dbf552ae4ed54cd2f46624ab47cc730c565b7d8d7de7cc51609540df05d0a46c932c20c36e
SSDEEP 12288:/h5UooqWolrP837JzHvA6izJgnnyFNmayiAZrvX4xO6:p5NoqWolrP837JzHvA6yknyWFxvoxO6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4064-132-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4064-137-0x0000000000400000-0x0000000000418000-memory.dmp

Download