ff828a8f30eebde4f762a1321ff1f7e12ff34696d7da2cd83ae62c96ab81ffcf

Analysis

max time kernel
141s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2023, 11:12

Target

Device/HarddiskVolume6/Sabari Backup/Downloads/DriverDownloader.exe
Size

5.1MB
MD5

3696d1e86bf61543963bceca8a07db31
SHA1

dd94e55b185fbfa188a027f15e30d036307fa596
SHA256

823296474f6e2ca98cc7feadab2413e07e1a9b776952a17877e39222ed3a844b
SHA512

7d98a7d1e2e10c06d017fb846a716dceba1428232dadb0349e3bd8a385007affb6a60a749d591427c7db3e90ef6ba29c78a17294c5ae15cb03a7dd18522c6631
SSDEEP

98304:b1QTFoiJXuo67quE9qk7+bgxy4d7GJtfIRqO22moa49Gte:x6v1uo6m9qk7i+bqtiu4b

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
3560	DriverDownloader.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3560	5084	DriverDownloader.exe	83
PID 5084 wrote to memory of 3560	5084	DriverDownloader.exe	83
PID 5084 wrote to memory of 3560	5084	DriverDownloader.exe	83

C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume6\Sabari Backup\Downloads\DriverDownloader.exe
"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume6\Sabari Backup\Downloads\DriverDownloader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\is-D3ESH.tmp\DriverDownloader.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-D3ESH.tmp\DriverDownloader.tmp" /SL5="$B0078,4610435,721408,C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume6\Sabari Backup\Downloads\DriverDownloader.exe"
  2⤵
  - Executes dropped EXE
  PID:3560

C:\Users\Admin\AppData\Local\Temp\is-D3ESH.tmp\DriverDownloader.tmp

Filesize
2.4MB

MD5
e56b13f185f5d1a0c4e2faf3d64b65f9

SHA1
b23000a311a6d1404bbfcbd544862b307211993c

SHA256
a4b773ab4bcbbc4844caf4a60bfda4faf4d67e874a84c00fde03656d5c0b77d5

SHA512
4f2d981524911005d8a109c6f1ca8faea3ca3d25ed6db1a27afff8c8b9f4715785e1e3a22e3bbde74986aaa79642abf59adb923cc52c3ac64d40bf0ba8506ff0

Download Submit
memory/3560-139-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/3560-143-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/3560-144-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/5084-133-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/5084-142-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download