ea407754e5406cc5f01f9d0b30b2d3c32cbbccb50305885334466f3cc594a625

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2023, 01:00

Target

9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f.exe
Size

15.0MB
MD5

03936e1d5952729c0c6bac3c200739cc
SHA1

d9eb8ad31e1d74f1b2bad2b664e8c632b1a246d6
SHA256

9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f
SHA512

cb74ce18c6e607abbf68b00c4831df4544154cc550fbaa98efc4bdf732fbafec23827f9e54a0fc53ee2472e611cdfe8f3636d4e5ca72256571d190ec29117605
SSDEEP

393216:3i5ceG7XLCPa18feHZSr7EdKTjxjj2hU0OcA:3veoLU3ryQhj90Ox

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1888	9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 1888	4660	9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f.exe	82
PID 4660 wrote to memory of 1888	4660	9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f.exe	82
PID 4660 wrote to memory of 1888	4660	9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f.exe	82

C:\Users\Admin\AppData\Local\Temp\9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f.exe
"C:\Users\Admin\AppData\Local\Temp\9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\is-UJF49.tmp\9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UJF49.tmp\9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f.tmp" /SL5="$501CA,14888405,831488,C:\Users\Admin\AppData\Local\Temp\9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f.exe"
  2⤵
  - Executes dropped EXE
  PID:1888

C:\Users\Admin\AppData\Local\Temp\is-UJF49.tmp\9b4c9c84d6ddc0ef3a817f2b7ea0a126297ccfbaf459f8014da7231523e9a27f.tmp

Filesize
3.0MB

MD5
915c6e21d5f0843d745b13d99107af5a

SHA1
a657b78527f416f1e81c055cf70016748bf44dda

SHA256
461338f8cef5aed887758e1667bd50c1b3f37a1250f9587e561faf048142822b

SHA512
b9492cd7d507f9f4816c03702b1e24ac33a803e9a4f0e1f659e7c6af38d1e40e608efe864bca469830ead3da3c5a45ed49afd8cc9f211d1978f3482a63591707

Download Submit
memory/1888-138-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/1888-141-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/1888-142-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/4660-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4660-140-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download