0e2ca9e900856db54c1cea37cbd05754296113da1a80297f3cfe36fa642b760a

Analysis

max time kernel
96s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2023, 02:09

Target

091_herpa_AJ.exe
Size

165KB
MD5

99e9010f29db663dc40e8304732c28d7
SHA1

531177055c87d7098a8cbd9f8accfcab26a63619
SHA256

0e2ca9e900856db54c1cea37cbd05754296113da1a80297f3cfe36fa642b760a
SHA512

f77a7ae82108f064ddc63577e423e6420777c6722d8a506bf00d1236e8b6649cfc40cdcec1a292b4acdf6b9966c5a65a368952c282eb3a801526a1f3e2978ece
SSDEEP

3072:Yf+GYrgxI0c5XI/NklH0iNL2Sl8BJoNEWoY46Uolqech:ndr0I0c5XICuiNLnluOdohPolY

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
712	nsvbixsibb.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 712	3500	091_herpa_AJ.exe
PID 3500 wrote to memory of 712	3500	091_herpa_AJ.exe	83

C:\Users\Admin\AppData\Local\Temp\091_herpa_AJ.exe
"C:\Users\Admin\AppData\Local\Temp\091_herpa_AJ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- \Users\Admin\AppData\Local\Temp\nsvbixsibb.exe
  2⤵
  - Executes dropped EXE
  PID:712

C:\Users\Admin\AppData\Local\Temp\nsvbixsibb.exe

Filesize
27KB

MD5
5da8c98136d98dfec4716edd79c7145f

SHA1
ed13af4a0a754b8daee4929134d2ff15ebe053cd

SHA256
58189cbd4e6dc0c7d8e66b6a6f75652fc9f4afc7ce0eba7d67d8c3feb0d5381f

SHA512
6e2b067760ec178cdcc4df04c541ce6940fc2a0cdd36f57f4d6332e38119dbc5e24eb67c11d2c8c8ffeed43533c2dd8b642d2c7c997c392928091b5ccce7582a

Download Submit
memory/712-135-0x000001EAF66C0000-0x000001EAF66C1000-memory.dmp

Filesize
4KB

Download