d25b5b057fbad1eef1db4a0d1c8219288bcc93d80e70836a88f1629a8ba16d7d

Analysis

max time kernel
1s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2023, 00:10

Target
file.exe
Size 1.2MB
Sample230711-af2lqafa5x
SHA256 d25b5b057fbad1eef1db4a0d1c8219288bcc93d80e70836a88f1629a8ba16d7d
MD5 9da0fb7c614cdf282f8b6c7117d12558
SHA1 52886f31045ab72802df0e77efb8188738d0537e
SHA512 5bd621e254f3147f0d481e1b0cd98a535012fab9a284686036b2b290df5686ef613b909b888f74c529dd56471feacc6aacf0b3f63ad00ff97c3bff572aefb6af
SSDEEP 24576:nfOyH3/GqzQFuj+EjzVYUODZBGQFpug5mE+oU+cdl2vSBreuS2w02VnKU:nGMhzQ86e2TDHRF0G+UcFeuZknn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1300	is-O3UCS.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 1300	5116	file.exe	85
PID 5116 wrote to memory of 1300	5116	file.exe	85
PID 5116 wrote to memory of 1300	5116	file.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\is-85M8R.tmp\is-O3UCS.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-85M8R.tmp\is-O3UCS.tmp" /SL4 $3021A "C:\Users\Admin\AppData\Local\Temp\file.exe" 942189 117760
  2⤵
  - Executes dropped EXE
  PID:1300

is-O3UCS.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-85M8R.tmp\is-O3UCS.tmp
Size 712KB
SHA256 68fd47d30592128096c574b6281493b9b8e2ca3e412ab7545d0df50d246a3f3f
MD5 d8c44f59161e44c570cc553a6c31daf5
SHA1 ca28b3950c2742c8c651bc438fa86524e9fb47f4
SHA512 6b4af10ad054df1f1d790002e56dfa8741c46e345b9705f321d92fa1246c75b7fa326f9f33d3fe6a6ccfe8d4c163b8e3dd847ac388e5d468e31ca4c683ddf390
SSDEEP 12288:7euHnWgyrwQV1rPja37nzHtA6SxCJdcNQR6tVFgG13/ZxOC:CuHcrwQV1rP+37nzHtA6NJdAVSm3/ZxJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-O3UCS.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-85M8R.tmp\is-O3UCS.tmp
Size 712KB
SHA256 68fd47d30592128096c574b6281493b9b8e2ca3e412ab7545d0df50d246a3f3f
MD5 d8c44f59161e44c570cc553a6c31daf5
SHA1 ca28b3950c2742c8c651bc438fa86524e9fb47f4
SHA512 6b4af10ad054df1f1d790002e56dfa8741c46e345b9705f321d92fa1246c75b7fa326f9f33d3fe6a6ccfe8d4c163b8e3dd847ac388e5d468e31ca4c683ddf390
SSDEEP 12288:7euHnWgyrwQV1rPja37nzHtA6SxCJdcNQR6tVFgG13/ZxOC:CuHcrwQV1rP+37nzHtA6NJdAVSm3/ZxJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5116-133-0x0000000000400000-0x0000000000423000-memory.dmp

Download