ef806cee914f03ec40db81468872eab8c1c8ac6498f2d5d813f19110ef44ab53

Analysis

max time kernel
142s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 06:38

Target

pw12-free.exe
Size

2.0MB
MD5

e63292c33622865f7190feb2c7c5d63a
SHA1

f3670bfc50d3200362a32ca2f40a0832fff19c07
SHA256

ef806cee914f03ec40db81468872eab8c1c8ac6498f2d5d813f19110ef44ab53
SHA512

35bfdfe90e8eb532157d93522c14e48c1f78707ccfe50475fac081c492690bd32306d00367d713df25a310d8d0b779b71edfc4f7862c64bba960bc4c4a24b39d
SSDEEP

49152:3v991R6nYbf+IVLTccdhCBEm1W1XmDytJwXqSXQb8P/U:f991YnYbfnLTccGamL2t6IeM

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
5084	pw12-free.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 5084	1868	pw12-free.exe	84
PID 1868 wrote to memory of 5084	1868	pw12-free.exe	84
PID 1868 wrote to memory of 5084	1868	pw12-free.exe	84

C:\Users\Admin\AppData\Local\Temp\pw12-free.exe
"C:\Users\Admin\AppData\Local\Temp\pw12-free.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Local\Temp\is-DNN4U.tmp\pw12-free.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DNN4U.tmp\pw12-free.tmp" /SL5="$E0056,1609288,488960,C:\Users\Admin\AppData\Local\Temp\pw12-free.exe"
  2⤵
  - Executes dropped EXE
  PID:5084

C:\Users\Admin\AppData\Local\Temp\is-DNN4U.tmp\pw12-free.tmp

Filesize
1.5MB

MD5
d8dabed8ae3c80f2f72eb5b6c4215177

SHA1
ff8e26be0f613863bc7af18e38d731a70284247e

SHA256
8c88a6a17a0fd1ee05a8dd3acb156a2d142fc060208da6c4cbb88258cc06b6cd

SHA512
6cd1d25603636ce9243b6bb8b9c3a8f84852c91569c1931555b492fd7229ef01d0576c34d4638aa2cbf737f7004f9c7031ca21fdb7cd9637c774dc90583a560e

Download Submit
memory/1868-133-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1868-142-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/5084-138-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/5084-143-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/5084-144-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download