02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
16/02/2023, 19:53

Target

02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe
Size

15.8MB
MD5

aec3f6554a36dec7ec9562fd0daeed69
SHA1

a54e1bae0ffe164da3e76c318df7bf986bc8b660
SHA256

02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479
SHA512

2fc6bd07ca248ced95bec04b57b10188b48e5b3f93c55413a0d88851eb1b470f3c4a1945fa6ada2870e0591a0d673e16baa0a894e430d2b8e39f20341277c488
SSDEEP

393216:qBhwbVT8NZBf8l582vT6U/Z7MQEQbKSSqaCb8g0:IwbV3EFyPbKOaCW

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4924	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4924	4712	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe	80
PID 4712 wrote to memory of 4924	4712	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe	80
PID 4712 wrote to memory of 4924	4712	02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe	80

C:\Users\Admin\AppData\Local\Temp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe
"C:\Users\Admin\AppData\Local\Temp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\is-5DOJL.tmp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5DOJL.tmp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp" /SL5="$90046,16225014,79872,C:\Users\Admin\AppData\Local\Temp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.exe"
  2⤵
  - Executes dropped EXE
  PID:4924

C:\Users\Admin\AppData\Local\Temp\is-5DOJL.tmp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp

Filesize
733KB

MD5
ff1ddfe4619bfff923fb5cbb5753fa2b

SHA1
3c0adfde84292c47ccd83fc3d5f6f35a2f84a6af

SHA256
0ddbe902f4e340b1a5bb4c79a1cdc55607114bb59bb678e2e38c41b69737a59a

SHA512
6419798d2afa462e5c689e0c09826d4f51a3fef659e681de8312edda8e7da0ab5bb932fe62eb9af7d0e34b7fe3a2cb6e43fdfbd6be785de00a8648eaff9840fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5DOJL.tmp\02cc58a094ff6ab2736805f7dd0f38a28debf945610f90a08c9668bacc782479.tmp

Filesize
733KB

MD5
ff1ddfe4619bfff923fb5cbb5753fa2b

SHA1
3c0adfde84292c47ccd83fc3d5f6f35a2f84a6af

SHA256
0ddbe902f4e340b1a5bb4c79a1cdc55607114bb59bb678e2e38c41b69737a59a

SHA512
6419798d2afa462e5c689e0c09826d4f51a3fef659e681de8312edda8e7da0ab5bb932fe62eb9af7d0e34b7fe3a2cb6e43fdfbd6be785de00a8648eaff9840fd

Download Submit
memory/4712-132-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4712-137-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download